DevOps Lounge Join
Tools

JWT decoder

Paste a token to read its header and payload, and see when it was issued and when it expires.

    Header
    Payload
    

    
  
  
    How it works
    • Decoded, not verifiedThe header and payload are only Base64URL-encoded, so anyone can read them. Checking the signature needs the key.
    • Never paste secretsTokens from production give access. Decode them here, where nothing is sent anywhere, then rotate any token you shared by mistake.
    
  
    Questions
    Can you verify the signature?
    Not here on purpose. Verifying needs your secret or public key, and a key should never be pasted into a website.
    Why does my token show as expired?
    The exp claim is in Unix seconds. If it is in the past, servers reject the token.
    
  
    More tools
    

    


    
  
    Built something with it?
    Show it in the server, get a code review, or ask the people who use these tools every day.
    
  Join on Discord