JSON Formatter and Validator
Format, compress, and validate JSON. See the exact location of syntax errors and optionally sort object keys.
Local processingJWT Decoder
About this tool
Inspect JSON Web Tokens without sending them to a server. Split header and payload, pretty-print claims like exp, iat, iss, aud, and scopes, and see decoding errors for malformed Base64URL segments. Signature verification is intentionally not performed—treat payload as untrusted.
Features
- Decode header and payload JSON
- Pretty-printed claim blocks
- exp/iat human-readable time hints when present
- Clear warnings that signature is unverified
- Copy header or payload JSON
How to use
- Paste JWT: Paste the full JWT.
- Decode: View the formatted header and payload.
- Inspect claims: Check expiry, issuer, and other claims. Note that signatures are not verified.
Examples
- View claims in an OAuth access token
- Check the expiry time represented by exp
- Understand the header, payload, and signature structure of a JWT
- Compare token contents from different environments
Limitations
- Does not validate signatures or trustworthiness
- Encrypted JWE tokens are not supported
- The JWT is decoded directly in your browser and is not sent to a server. Decoding does not verify its signature.
FAQ
- Is it safe to paste my JWT here?
- Decoding is local, but anyone with the token can often use it until expiry. Avoid pasting sensitive production tokens on shared computers.
- Why does it say signature not verified?
- Verification needs the issuer public key or secret. This tool only Base64URL-decodes JSON parts.
- Can I see if a token expired?
- If exp is present, the decoder shows a readable expiry time next to the Unix timestamp.