Base64 Encoder / Decoder
Encode and decode Base64 and URL-safe Base64, including files and Basic Auth headers.
JWT Decoder
Paste a JWT to see its header, payload and signature, with timestamps converted to readable dates. Decoding happens locally: the token is never sent anywhere.
- Free
- No sign-up
- Runs in your browser
Decoded in your browser. The token is never sent anywhere or saved in the page URL.
Header
Payload
Claims
| Claim | Value | Meaning |
|---|
Verify signature
How to use the JWT Decoder
- Paste the token, usually found after “Bearer” in an Authorization header.
- Read the header to see the algorithm, then the payload claims.
- Check the expiry status and dates.
- For HS256, HS384 or HS512 tokens, enter the secret to verify the signature.
Monitor what your code does after it ships
Send events to SensaCat’s ingest API and get alerted when jobs, webhooks and multi-step flows stall.
Frequently asked questions
Usually not. A standard signed JWT is only Base64URL-encoded, so anyone with the token can read its claims. The signature prevents tampering, not reading, so never put secrets in a JWT payload.
They are Unix timestamps in seconds: exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted.
No. Decoding only reads the token. Your server must verify the signature with the right key and check exp, nbf, iss and aud before trusting it.
A token with alg set to none has no signature. A library that accepts it lets anyone forge tokens, so servers should reject it and only allow the algorithms they expect.
Related tools
Unix Timestamp Converter
Convert epoch timestamps to dates and back in any time zone, with unit detection.
Webhook Signature Verifier
Check an HMAC webhook signature for Stripe, GitHub, Shopify, Slack or your own scheme.