Skip to content
JustDevTools
  • JSON formatter and validator
    Format, minify and validate JSON, with the exact line and column of any syntax error.
  • JWT decoder
    Read a JWT's header and payload, with issued-at and expiry times shown as real dates.
  • Base64 encoder and decoder
    Encode and decode Base64 and Base64URL, with full Unicode support.
  • JSON to TypeScript, Zod and Java
    Paste a JSON response and get TypeScript interfaces, a Zod schema or Java classes with Jackson annotations.
  • YAML to JSON converter
    Convert YAML to JSON and JSON to YAML, with the exact line of any syntax error. Handles multi-document files.
  • Regex tester
    Test JavaScript regular expressions with live match highlighting, capture groups and replace preview.
  • URL encoder and decoder
    Percent-encode and decode URLs and query values, and break a URL into its parts and parameters.
  • Unix timestamp converter
    Convert Unix timestamps in seconds or milliseconds to dates, and dates back to timestamps.
  • Cron expression explainer
    See what a cron expression means in plain English, what each field does and the next times it will run.
  • JSON to CSV converter
    Turn a JSON array into CSV for Excel or Google Sheets, or a CSV file into JSON. Nested objects become columns.
  • UUID generator and inspector
    Generate UUID v4 and time-ordered v7 in bulk, or paste a UUID to see its version and timestamp.
  • Text diff checker
    Compare two texts line by line and see exactly what was added, removed or changed.
  • Hash and HMAC generator
    SHA-256, SHA-1, SHA-384 and SHA-512 hashes and HMAC signatures of text, in hex or Base64.
  • Markdown previewer
    Write Markdown on the left and see it rendered live on the right, with GitHub-style tables and task lists.

JWT decoder

Read a JWT's header and payload, with issued-at and expiry times shown as real dates.

Runs locally. Nothing you paste leaves this tab.

The decoded header and payload appear here.

What a JWT contains

A JSON Web Token is three Base64URL-encoded parts joined by dots: a header, a payload and a signature. The header says how the token was signed. The payload holds the claims: who the token is for, who issued it and when it expires. The signature proves the first two parts weren’t changed.

Anyone can read a JWT’s header and payload; they are encoded, not encrypted. Never put secrets in a JWT payload.

Standard claims

  • iss (issuer): who created the token, usually your identity provider’s URL.
  • sub (subject): the user or client the token represents.
  • aud (audience): the API the token is meant for. APIs should reject tokens meant for someone else.
  • exp (expiry), iat (issued at), nbf (not before): Unix timestamps in seconds.
  • scope or scp: the permissions granted, often space-separated.

Debugging 401 errors

When an API rejects a token, check these in order:

  1. Has it expired? Compare exp with the current time shown above.
  2. Is aud the API you’re calling? Tokens issued for one API are often rejected by another.
  3. Does scope include the permission the endpoint needs?
  4. Is the server clock in sync? A few minutes of clock skew can make a fresh token look not yet valid.

Why this tool doesn’t verify signatures

Verifying a signature needs the signing secret (for HS256) or the issuer’s public key (for RS256 and ES256). Pasting a production secret into any website is a risk, so verification belongs in your backend, using a maintained library such as jose for Node.js or Spring Security’s resource server for Java.