CodeClean
All tools

JSON

JSON FormatterJSON ValidatorJSON MinifyJSON EscapeJSON to YAMLJSON to CSVJSON ViewerCSV to JSONJSON to XMLJSON to TypeScriptJSON RepairJSON Stringify

Markup & data

YAML ValidatorYAML FormatterXML FormatterHTML FormatterHTML MinifierMarkdown FormatterXML to JSONYAML to JSONHTML to MarkdownMarkdown to HTML

Stylesheets & scripts

CSS FormatterCSS MinifierJavaScript BeautifierJavaScript MinifierTypeScript FormatterGraphQL Formatter

SQL

SQL FormatterPostgreSQL FormatterMySQL FormatterSQL Server (T-SQL) FormatterOracle PL/SQL FormatterBigQuery FormatterSnowflake FormatterSQLite FormatterSQL Minifier

Compare & match

Regex TesterRegex Cheat SheetDiff CheckerJSON Compare

Encode & decode

Base64 DecodeURL DecodeJWT DecoderUUID GeneratorBase64 EncodeImage to Base64Base64 to Image

JWT Decoder

Paste a JSON Web Token to read its header and claims. Timestamps are shown as dates and the token’s expiry is checked against your clock. Nothing is sent anywhere.

Encoded token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjdXN0XzQxMiIsIm5hbWUiOiJBZGEgTG92ZWxhY2UiLCJyb2xlIjoic3RhZmYiLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTc5MDAwMzYwMH0.MHpK9AswEhHE-zqO8-VvFRDp9pd1p6y_09gb9KdqDAI

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Algorithm HS256

Payload

{
  "sub": "cust_412",
  "name": "Ada Lovelace",
  "role": "staff",
  "iat": 1790000000,
  "exp": 1790003600
}

Verify the signature (optional)

Checked with your browser’s Web Crypto API — the key is never sent anywhere. Supports HS256/384/512 secrets and RS, PS and ES public keys.

Claims explained

subSubjectcust_412
nameNameAda Lovelace
roleRolestaff
iatIssued at2026-09-21 14:13:20 UTC ()
expExpires2026-09-21 15:13:20 UTC ()

Anatomy of a JWT

A JWT (RFC 7519) is three Base64URL strings joined by dots: header (algorithm and type), payload (the claims) and signature. The first two are just encoded JSON — anyone holding the token can read them, which is exactly what this page does. Never put secrets in a JWT payload.

Decoding is not verifying

The signature proves the token was issued by someone holding the key and that nobody changed it. To check it, paste the shared secret (HS256/384/512) or the issuer’s PEM public key (RS, PS and ES algorithms) into the optional Verify box. Verification runs in your browser with the Web Crypto API, and the key is never transmitted. The sample token is signed with the secret codeclean-demo-secret — try it, then change one character and watch verification fail. In production, always verify on your server with a maintained library.

Standard claims

ClaimMeaning
issIssuer — who created the token
subSubject — usually the user ID
audAudience — who the token is for
expExpiry time (Unix seconds)
nbfNot valid before
iatIssued at
jtiUnique token ID

Questions

Is it safe to paste a production token here?

Decoding happens in your browser and nothing is transmitted or stored. Still, a live token is a credential — treat it like a password and prefer expired or test tokens.

Why does it say the token is expired?

The exp claim is earlier than your device’s current time. If your clock is wrong, the verdict will be too.

How do I verify a JWT signature?

Paste the secret (for HS256/384/512) or the PEM public key (for RS/PS/ES algorithms) into the Verify box under the decoded token and press Verify. It uses your browser’s Web Crypto API; nothing is uploaded. For JWKS endpoints, copy the key out as PEM first.

Can it decode JWE (encrypted) tokens?

No. A JWE has five parts and an encrypted payload that needs the key to read.

Related tools