What to select
Paste a three-part JWT to decode its header, payload and standard timestamp claims without verifying or transmitting it.
JWT Decoder & Inspector
Decode JWT headers and claims, inspect timestamps and check expiration locally.
We use reasonable safeguards to help protect your files and information while you use the service.
Decoding does not verify the signature or authenticity. Avoid pasting production tokens unless you understand the risk; this value stays in this browser tab.
0 characters · 0 UTF-8 bytes. Up to 1,000,000 characters. Processing stays in this browser.
What this developer tool does
Decode a JWT header and payload, show standard claim dates, and detect expiration without sending the token anywhere.
How to use JWT Decoder & Inspector
- Paste a three-section JWT or use the deliberately non-secret sample.
- Inspect the decoded header, payload, claim dates, and expiration status.
- Treat the result as untrusted until a trusted system verifies the signature.
Example
An exp claim is displayed as an ISO date and compared with browser time.
Practical note: This inspector does not verify signatures, issuers, audiences, keys, or token authenticity.
Supported formats
Plain text, JSON, XML, standard or URL-safe Base64, URL components, UUID v4, secure passwords, SHA-256, SHA-384, SHA-512 and CRC32.
Limits and safety
Text input is limited to 1,000,000 characters per task, UUID generation to 100 values, and passwords to 8–128 characters.
Frequently asked questions
Is my input uploaded or saved?
No. These developer utilities process input only in this browser tab.
Can a generated hash be reversed?
No. Cryptographic hashes are one-way values. CRC32 is a checksum for detecting accidental changes, not a security hash.