Tooloat

JWT decoder and debugger

Paste a JSON Web Token to read its header and payload, see when it expires and check the signature with a secret or public key. Time claims are shown as readable dates. Tokens are decoded in your browser and are never transmitted.

Tooloat runs in your browser and needs JavaScript. It opens in a moment, and your files are processed on your device.

How it works

  1. Paste your JWT.
  2. Read the header and claims, and the expiry status.
  3. Optionally enter a secret or public key to verify the signature.

Why use it

  • Readable dates for exp, iat and nbf.
  • Verifies HMAC, RSA and ECDSA signatures.
  • Shows algorithm warnings such as none.
  • Your token never leaves the page.

Questions and answers

Is it safe to paste a real token?

Decoding happens locally and nothing is sent. Still, treat production tokens as secrets and prefer test tokens when you can.

Can it verify a signature?

Yes, with the shared secret for HS256 or the public key for RS256 and ES256.

Why does my token show as expired?

The exp claim is a Unix time. The tool compares it with the clock on your device.

Related tools