Open a JSON Web Token and show what is inside: the header’s algorithm, every field of the payload, and the issued, valid-from and expiry dates converted to local time.
A JWT is not encrypted, only Base64-encoded: anyone holding it can read the contents. Which is why you should never put anything in one you would not want seen.
How to use it
- Paste the token, with or without the Bearer prefix.
- Read the header and the payload.
- Check the expiry line.
Frequently asked questions
- Is the signature verified?
- No. Verifying it would need the issuer’s secret or public key, and this tool has neither. It is for seeing the contents, not for deciding whether the token can be trusted.
- Does the token reach a server?
- No. The decoding is plain Base64 done in the tab, which matters rather a lot when what you are pasting is a live session token.
- What does expired mean?
- That the exp field is earlier than now. Many servers allow a few seconds of clock skew, but an expired token is normally rejected.
Related tools
JSON to CSVAn array of objects into a table, flattening nested objects.
CSV to JSONDetects the separator, respects quotes and types the values.
JSON to YAMLA straight conversion that keeps the key order.
YAML to JSONTakes files with several documents in them.
Format and validate JSONIndent, minify or sort keys, and get the error’s line and column.