JWT Tools
Decode JWT header and payload, inspect claims and expiry, mint unsigned tokens for UI tests. Decoding is not verification.
5 tools · 100% browser-based · No uploads · No signup
About these JWT tools
JSON Web Tokens are three Base64url parts: header, payload, signature. These tools decode claims, show expiry, list registered claims, measure size, and mint unsigned or demo tokens for UI tests. They do not verify signatures against your production keys, and they should not.
Decoding a JWT is not authentication. Anyone can read a typical payload. Put secrets in the token only if you accept that every client can see them. The generator is labeled for testing because an unsigned token is not a security boundary.
Tools in this category
JWT Decoder
Decode is not verify. A readable payload is not a trusted user.
Expiration Checker
JWT expiration checker online. Check if your JWT is expired, see time remaining, and view exp/iat/nbf timestamps in human-readable format with timezone support.
Claims Viewer
JWT claims viewer online. View and understand all JWT claims with descriptions. Highlights standard claims (iss, sub, aud, exp) and flags missing recommended claims.
JWT Generator
JWT generator online for testing. Create unsigned or demo JWT tokens for UI testing. NOT for production—generates test tokens with custom header and payload.
Size Analyzer
The JWT spec has no size limit. Your cookie jar and your reverse proxy do.
How these tools run in your browser
We split on dots, Base64url-decode header and payload, and pretty-print JSON. Expiration reads exp, nbf, and iat as Unix seconds. Size counts characters of the compact serialization. Generator assembles a header and payload you edit; signature may be omitted or a dummy.
Common Use Cases
- Read claims in a token from localStorage while debugging a 401
- See whether exp is in the past in your timezone
- Check if the token is too large for a cookie header
- Build a fake token so a frontend storybook can render an "authenticated" state
Common Mistakes
Frequently Asked Questions
No. Verification checks the signature. Decoding only reads the JSON. Never trust claims from a token you have not verified on a server.
It stays in this tab. Treat tokens like passwords anyway: they are bearer credentials.
Permissions arrays, profile photos as data URIs, or duplicated claims. Prefer opaque session IDs in cookies for large authorization data.