TASK

Inspect a JWT token: decode header and payload without verifying

Read the structure of a JSON Web Token to see its algorithm, claims, and expiry — purely client-side, no server validation.

1

A JWT is three Base64URL-encoded JSON segments (header.payload.signature) joined by dots. The header and payload are not encrypted — anyone can decode them. Only the signature (which requires the secret/public key) proves authenticity.
2

JWT Decoder →
Paste the JWT. The tool decodes the header and payload, renders the claims as formatted JSON, and highlights the exp/nbf/iat time claims with human-readable dates.
3

base64-decode → json-format
View recipe Open in Toolchain

Use the parse chain to decode the JWT and additionally check whether exp/nbf claims are in the past/future, giving a quick 'is it currently valid?' signal.
4

Remember: decoding a JWT is NOT verification. The payload can be forged by anyone. Never trust JWT claims for authorization without verifying the signature server-side with the secret or public key.

Frequently asked questions

Can I trust the claims in a JWT I decoded?: No. The header and payload are Base64-encoded, not encrypted. Anyone can create a token with any claims. Only signature verification (using the secret for HS256, or the public key for RS256) proves the claims were issued by a trusted party.
What does 'exp' claim mean?: exp is the expiry time as a Unix timestamp. After exp, the token should be rejected. The tool converts it to a readable date so you can see at a glance whether the token is still time-valid.

Workflows that solve this

Base64 encode then decode round-trip

Encode text to Base64 and decode it back to verify the round-trip preserves the original data.

Convert Base64 to Base85

Decode Base64 and re-encode as Base85 for compact representation.

Convert Base64 to Hex

Decode a Base64 string into raw bytes and re-encode it as hexadecimal for inspection or interop.

Compare two YAML configs via JSON

Convert YAML configs to JSON for diff-friendly comparison of structured values.

Decode a Basic Auth credential pair

Decode the Base64 portion of an HTTP Basic Authorization header into username:password.

Encode a JSON payload for URL transport

Prepare a JSON document for a URL parameter: pretty-print, Base64-encode, then percent-encode — the exact inverse of the nested-parameter decode chain.

HJSON to JSON Format

Format HJSON then convert to standard JSON.

Format JSON and compute integrity checksum

Pretty-print a JSON document and compute a CRC32 checksum to detect any subsequent modifications.

Minify and validate JSON

Format JSON for inspection and validate it is syntactically correct in one pass.

Format JSON and generate TypeScript interface

Format a JSON document then infer a TypeScript interface definition in one chain.

Validate, format, then convert JSON to YAML

Convert a (possibly minified) JSON config to YAML, catching syntax errors at the first node instead of producing subtly wrong YAML.

JSON5 to JSON Format

Format JSON5 then convert to standard JSON.

JSONC to JSON Format

Format JSONC (JSON with comments) then convert to standard JSON.

Decode JWT and inspect payload

Decode a JWT token to its header and payload, then pretty-print the JSON for inspection.

Decode and format a JWT payload

Parse a JWT token, extract its payload, and format the JSON for inspection.

Parse Query String and Format JSON

Parse query string into key-value pairs then format as JSON.

Convert TOML to JSON

Parse a TOML configuration file into JSON for tools and APIs that expect JSON input.

Convert TOML to YAML via JSON

Transform a TOML configuration file into YAML format, using JSON as an intermediate representation.

Decode nested URL parameter (Base64 JSON)

Unwrap a URL parameter that carries URL-encoded Base64 JSON into readable, formatted JSON.

Generate TypeScript interfaces from YAML

Convert a YAML document to TypeScript interface definitions, using JSON as an intermediate format.

Learn more

Want to understand why?

How to Build a Secure API Gateway

Design a secure API gateway that handles authentication, rate limiting, request validation, and threat protection for backend services.

How to Encode JWT Tokens

Create JSON Web Tokens with a header, payload, and signature for authentication.

Anti-CSRF is the set of measures that defend against cross-site request forgery, including CSRF tokens, SameSite cookies, and Origin/Referer checks.

Broken Access Control

Broken access control is missing or bypassable authorization checks that let users perform actions or access resources they are not entitled to.

Related tools

Decode and inspect JWT header, payload, and time claims with expiry status. Free, private, and 100% client-side.

Encode JWT with HS256. Free, private, 100% client-side. Not for server-side verification.

Decode Base64 data back to readable text online. Free, private, and 100% client-side.