Read a token header and payload as plain JSON, with expiry dates in readable form. The signature is never verified here, and the token never leaves your browser.
Your files are processed in your browser, on your own device. Nothing is uploaded to a server.
The JWT Decoder opens a JSON Web Token so you can read its header and payload as JSON, with the time claims shown as readable dates. It decodes only: the signature is NOT checked, so a token you read here proves nothing about who signed it. It is free, runs in your browser, and the token never leaves your device.
A token is three Base64URL parts joined by dots. The tool decodes the first two parts into readable JSON and lays the claims out in a table, with exp, iat and nbf converted from raw numbers into dates you can read at a glance. A status line then says whether the token is past its expiry time or not yet valid, and a warning appears when the header names the algorithm as none.
The signature is shown as a byte length and nothing more. Raw signature bytes are not readable, and there is nothing honest a reading tool can do with them beyond say how long they are. If the token holds no exp claim, the status line says that plainly too, because a token without an expiry never runs out by its own claims.
Debugging a login is the everyday job. An API keeps answering 401, and the questions are always the same. Has the token expired? Does it hold the role or scope the API expects? Which issuer and audience does it name? The claims table answers all three in one paste.
Surprise logouts come next. A session ends earlier than anyone expects, and the exp date in the payload tells you whether the provider issues short-lived tokens or something else cut the session. Reading the real date beats guessing from the outside.
Support and teaching round it out. Walking a teammate through what your auth provider actually puts in a token is far easier with the claims laid out and a report you can attach to the ticket. Handling a live token is also where the privacy of this page earns its keep. Some online decoders send the token to their server just to format the JSON. A token is a credential, and this page never sends it anywhere.
It does not verify the signature. Nothing on this page checks the token against any key, so the claims you read are what the token says, not what anyone has proven. Never treat a decoded token as a trusted token, and never let a tidy payload talk you into skipping real checks in your own code.
Trust decisions belong to servers. Whether the issuer is the real issuer, whether the audience matches your API, and whether the token has been revoked are calls only the issuing system and the receiving API can make. This page reads the token. It cannot vouch for it.
One more limit follows from how tokens are built. Anyone who holds a token can read everything in its payload, because the payload is encoded, not encrypted. Keep secrets out of payloads, and give a pasted token the same care you would give a password. The tool also reads the standard three-part token only. It does not open encrypted tokens or fetch keys from an issuer.
The decoding runs on your device. Your token is not sent to a server, not logged and not stored by ToolPeko, which matters more here than on most pages because tokens are credentials. There is no account and no daily cap. Close the tab and the token is gone.
No. It decodes the header and payload so you can read them. The signature is not checked against any key, so a token read here proves nothing about who signed it.
The exp claim in the payload names a date and time, and that moment has passed. The claims table shows the date in readable form so you can see by how much.
It means the header says the token is unsigned. An unsigned token carries no signature at all, so the page flags it in plain sight rather than decoding it quietly.
The token never leaves your browser on this page, and nothing is sent to a server. Still treat tokens as credentials in general, and be wary of decoder sites that process tokens on their own servers.
Raw signature bytes are not readable, so a length is the honest summary of that part. The signature is also not verified here, so there is nothing more this page can truthfully say about it.
Some tokens carry no exp claim, and the status line will say so. Such a token does not expire by its own claims, which is worth knowing if you issued it.
Same rules as this one: free, in your browser, with nothing uploaded.
Paste messy JSON, get it neat and valid.
Check JSON and find the exact line that breaks it.
Squeeze JSON down to one tight line.
Open JSON as a tree you can fold and explore.
JSON rows turned into a CSV a spreadsheet can open.
A CSV file turned into clean JSON objects.
JSON rewritten as YAML for config files.
YAML config turned into JSON you can use in code.