JWT decoder
Paste a JWT to read its header and decoded payload, with the timestamps (exp, iat, nbf) turned into readable dates and the expiration state shown. Three Base64URL chunks separated by dots hide the claims, and a token past its exp has quietly stopped being valid. The token stays in your browser, so a bearer credential you are inspecting is never sent anywhere.
- 100% local
- Free · no account
- Instant result
This tool runs entirely in your browser — nothing is sent to a server.
A JWT (JSON Web Token) carries signed information between a server and a client: three segments separated by dots — header (algorithm), payload (the “claims”: subject, roles, expiry) and signature. The header and payload are plain Base64URL: they can be read without any key.
This decoder displays the header and payload as readable JSON, converts the timestamps (exp, iat, nbf) into dates and tells you whether the token is expired — handy for debugging authentication. The signature is not verified: that is your server’s job.
How it works
Type the figures or drop the file you want to process — the tool checks them as you go.
Everything is computed directly in your browser. Nothing is sent to a server.
The result appears instantly, with the detailed breakdown ready to copy, download or keep.
Why use this tool
No account, no download, no limit: the result appears as soon as you enter your data.
Every rule, algorithm and check reflects what we use ourselves every day at Flexina.
The calculations follow the official standards, and the step-by-step detail lets you double-check the outcome.
What does running it locally bring you?
Files, figures and documents never leave your device: nothing is stored, nothing is sent.
Once the page is loaded, you can cut the network: the tool keeps working.
No upload, no account, no third-party server in between: results stay fast and fully private.
Frequently asked questions
Does decoding a JWT “crack” it?
No: a JWT’s content is readable by design, only the signature guarantees its integrity. That is why you must never put sensitive data in one (passwords, unnecessary personal data).
What do exp, iat and nbf mean?
They are Unix timestamps: iat = issued at, exp = expires at, nbf = not valid before. The tool converts them to readable dates and compares exp with the current time.
Can I paste a production token here?
The token never leaves your browser. Still, be careful: a valid JWT is a pass — avoid sharing it or pasting it into online tools whose behaviour you do not know.