JWT decoder

Decode a JSON Web Token and view the header, payload and expiry date. Local only, the token is not sent anywhere.

Runs in your browser · nothing is sentTokens & identity

JWT

About this tool

Paste a JWT and view its contents. The signature is not verified, this is only a viewer.

🔒 Your input stays in your browser and is never sent anywhere.

Is it safe to paste a production token?

Decoding happens in your browser. Still, never share valid tokens with others.

Does this tool verify the signature?

No. For that you need the key and a server or library.

Base64 encoder/decoderEncode text to Base64 or decode Base64 back to text, including Unicode and URL-safe variants.
HMAC generatorCreate HMAC signatures with SHA-1, SHA-256, SHA-384 or SHA-512. Calculated locally, your key never leaves the browser.
IAM Policy analyzerPaste an AWS IAM policy to find overly broad permissions, privilege escalation paths and confused-deputy risks, and simulate requests.
Timestamp converterConvert Unix timestamps to readable dates and back. Shows UTC, local time and ISO 8601.

Found a problem or have a suggestion? Tell us