JWT decoder and Unix timestamp

Free

Online JWT decoder and Unix timestamp converter. Free.

JWT decoder

Paste a three-part token (header.payload.signature). The signature is not verified — without the secret you cannot prove the token is authentic.

Header

Paste a JWT to see a formatted header and payload.

Payload


					

					

						
Signature

						

						
Shown as text. HMAC/RSA verification stays in your app, with the secret or public key.

					

				

			

		


		

			

				

					
Unix timestamp converter

					
Accepts seconds or milliseconds. Very large numbers are treated as milliseconds automatically.


					

						

							
							
						

						

							
							
						

					


					

						
						
					


					

						
						
						
						
					


					

						

							UTC (ISO 8601)
							—
						

						

							Your local time
							—
						

						

							Relative
							—
						

						

							Now in this browser
							—
						

					

				

			

		

	


	

		

			

	

		
How the JWT decoder and timestamp converter work

	

	

					
A typical JWT has three dot-separated parts: header, payload and signature, each in URL-safe Base64. This tool splits them in the browser, pretty-prints the JSON and turns iat, nbf and exp into readable dates.

							
The timestamp converter goes the other way: from a Unix number or a local datetime you get UTC ISO, your local time and a relative phrase. Nothing leaves the page — useful when you are inspecting a token from an API or from Laravel Sanctum/Passport.

				
					

									

						

															JWT
														Header and payload
							
See the algorithm, type and claims without sending the token anywhere.

						

					

									

						

															Time
														exp, iat, nbf
							
Numeric time claims also appear as dates, so you can see immediately if the token has expired.

						

					

									

						

															Unix
														Seconds or ms
							
Convert a timestamp from logs, a JWT or a database into local time.

						

					

							

		
					

									Important: 
								Decoding is not validation. Without the secret or public key, anyone can fabricate a payload that looks fine. Do not paste production tokens on a shared screen.
			

			



		

		

			

	

		
Useful notes

	

	

		
    
							
  • 
					 
					A five-part JWT is usually JWE (encrypted). The payload cannot be read without the decryption key.
				
    • 
							
  • 
					 
					exp, iat and nbf are Unix seconds, not milliseconds, in standard JWTs.
				
    • 
							
  • 
					 
					JavaScript Date uses milliseconds. If a log shows 13 digits, it is almost certainly milliseconds.
				
    • 
							
  • 
					 
					The signature stays unverified here. Verify the token in your app with that language’s JWT library.
				
    • 
							
  • 
					 
					The sample on this page is fictional, so you can see the format. Replace it with your own test token.
				
    •