JWT decoder and debugger
Paste a JSON Web Token to read its header and payload, see when it expires and check the signature with a secret or public key. Time claims are shown as readable dates. Tokens are decoded in your browser and are never transmitted.
Tooloat runs in your browser and needs JavaScript. It opens in a moment, and your files are processed on your device.
How it works
- Paste your JWT.
- Read the header and claims, and the expiry status.
- Optionally enter a secret or public key to verify the signature.
Why use it
- Readable dates for exp, iat and nbf.
- Verifies HMAC, RSA and ECDSA signatures.
- Shows algorithm warnings such as none.
- Your token never leaves the page.
Questions and answers
Is it safe to paste a real token?
Decoding happens locally and nothing is sent. Still, treat production tokens as secrets and prefer test tokens when you can.
Can it verify a signature?
Yes, with the shared secret for HS256 or the public key for RS256 and ES256.
Why does my token show as expired?
The exp claim is a Unix time. The tool compares it with the clock on your device.
Related tools
- Base64 encoder and decoderConvert text or files to Base64 and back.
- JSON formatter and validatorPaste JSON and get it pretty printed, minified or key sorted.
- Unix timestamp converterTurn an epoch value into a readable date, or a date into a timestamp.
- Hash generator and file checksum calculatorCheck that a download is intact or that two files are identical.