Suishou Tools

JWT Decoder

Paste a JWT to see its header and payload as formatted JSON. Time claims such as exp and iat are converted to dates in your time zone, and a live countdown tells you whether the token has expired.

This tool decodes the token only and does not verify the signature. Anyone can decode a JWT, so never put passwords or other secrets in one. Whether the signature is valid can only be checked by a server that holds the key.

How to use the JWT Decoder

  1. Paste the token into “Paste a JWT”. A leading “Bearer ” copied from an Authorization header is removed automatically.
  2. Read the header (algorithm and token type) and the payload (the claims) as formatted JSON.
  3. Check the status line for whether the token is still valid, and the registered claims table for issuer, subject, audience and times.
  4. Click “Load sample” to see an example token that expires in one hour.

How a JWT is structured

A JSON Web Token (RFC 7519) is three Base64URL-encoded parts joined by dots: header.payload.signature. The header says which algorithm signed the token (for example HS256 or RS256). The payload holds the claims, such as the user ID, roles and expiry time. The signature lets the server prove the first two parts were not altered.

The header and payload are only encoded, not encrypted. Anyone who has the token can read them, which is exactly what this tool does. Never put passwords, API secrets or sensitive personal data in a JWT payload.

Registered claims: exp, iat, nbf and more

RFC 7519 defines a set of standard claim names. iss is the issuer (the auth server), sub the subject (usually the user ID), aud the audience (the API the token is meant for), and jti a unique token ID that can be used to prevent replay.

exp (expiration), nbf (not before) and iat (issued at) are NumericDate values: seconds since January 1, 1970 UTC, not milliseconds. A common bug is setting exp with JavaScript’s Date.now(), which is in milliseconds and produces a token that expires thousands of years from now. This tool shows each time claim in your local time zone next to the raw number.

Decoding is not verifying

Decoding shows what a token claims; verifying proves the claims came from a trusted issuer. To verify an HS256 token you need the shared secret, and for RS256 or ES256 you need the issuer’s public key, typically fetched from its JWKS endpoint (such as /.well-known/jwks.json). Use a maintained library such as jose for Node.js, PyJWT for Python or the JWT support built into your framework.

A token with "alg": "none" has no signature at all. Servers must reject it; accepting it was a classic vulnerability in early JWT libraries.

Common JWT use cases

OpenID Connect ID tokens from Google, Microsoft Entra ID, Auth0, Okta or AWS Cognito are JWTs, as are many OAuth 2.0 access tokens. Decoding one is the quickest way to debug a 401 error: check that aud matches your API, iss matches the expected tenant, the token has not expired, and the scopes or roles you need are present.

Frequently asked questions

Is it safe to paste a real token here?

The token is decoded entirely in your browser and never sent anywhere. Still, a valid access token works like a password until it expires, so avoid pasting live production tokens into any website you don’t control.

Can this tool verify the signature?

No. Verification needs the secret or public key, which only your server should hold. This tool shows the algorithm and signature so you can check them, but it doesn’t validate them.

How do I convert exp to a date?

exp is the number of seconds since 1970-01-01 UTC. Multiply by 1,000 and pass it to new Date() in JavaScript, or use datetime.fromtimestamp(exp, tz=timezone.utc) in Python. This tool does it for you and shows the result in your local time.

Why does it say “five-part encrypted JWT (JWE)”?

A JWE has five parts and its payload is encrypted, so it can’t be read without the decryption key. A normal signed JWT (JWS) has three parts.

Why is my token not valid yet?

Its nbf (not before) time is in the future. This often happens when the issuing server’s clock is ahead of yours; many libraries allow a small clock skew of 30 to 60 seconds for this reason.

What is the difference between an ID token and an access token?

An ID token (OpenID Connect) tells your app who the user is and is meant for the client. An access token grants access to an API and is meant for the resource server. Both are often JWTs, but you should only send access tokens to APIs.

Last updated: View source code

Base64 Encode and Decode Turn text into Base64 or decode a Base64 string back to readable text. Everything is handled as UTF-8, so accented letters, emoji and non-Latin scripts come back exactly as they went in. JSON Formatter Paste JSON to validate and pretty-print it instantly, or minify it into a single line. If it is invalid, you get the exact line and column plus a plain-English explanation of what is wrong. Unix Timestamp Converter Check the current Unix timestamp, or convert between epoch time and human-readable dates. Seconds and milliseconds are detected automatically, and every result is shown in your local time, UTC and ISO 8601. Hash Generator Calculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for any text or file in one go. Paste a published checksum to confirm that a download is intact and untampered. Color Converter Convert any CSS color between HEX, RGB, HSL and OKLCH, and see right away whether white or black text on it passes WCAG contrast. Works with transparency too. Roman Numeral Converter Type a number to get its Roman numeral, or type a Roman numeral to get the number. Each result is broken into parts, so you can see how it is built. URL Encode and Decode Percent-encode text for use in a URL, or decode %XX sequences back into readable text. Paste a full link below to break it into its scheme, host, path and decoded query parameters. Number Base Converter Type a whole number in binary, octal, decimal, hex or any base from 2 to 36 and every other base updates instantly. Big numbers stay exact, and the two’s complement panel shows how the value is stored in 8 to 64 bits.