JWT decoderConverters

JWT decoder. Read a token without sending it anywhere.

Paste a JWT and see the header, the payload and whether it has expired. Decoding happens on this page. The signature is shown but not checked, because that needs a secret that does not belong in a web page.

Cost to you

Free

Runs in your browser. No signup, no API call, no limit per hour.

browser
runs in
none
API calls
none
account

Use it now

Use the JWT decoder here

It runs in your browser. Nothing you type is sent anywhere, there is no signup and no limit.

Loading the tool.

Run it from your agent

Copy one prompt, give it to your agent.

Fill in the placeholder, paste it, and the agent runs the same job with current data on your looot account and shows the cost.

  • You give it: a json web token.
  • Billed per call, nothing while your agent is idle.
  • The agent shows the price before it calls.
Prompt: JWT decoder
Use looot to check an API token before a run. 1. Set up https://looot.ai/skill.md. 2. Decode this JWT on this machine only, never send it to any endpoint: [paste a token you are allowed to share]. 3. List alg, iss, aud, sub, scopes and exp as a UTC date. 4. Say whether it has expired and what the expiry means for a long batch of calls.

Give this to your agent
Setup command
set up looot - https://looot.ai/skill.md

What comes back

What your agent gets from jwt decoder

Field names as the providers return them. The exact set varies by endpoint, and your agent reads it from the catalog.

  • header JSON
  • payload JSON
  • issued, not before and expiry times
  • expired or not
  • warnings such as alg none

Use it for

What people do with jwt decoder

  • Debug a 401

    See at once if the token expired, has the wrong audience or lacks a scope.

  • Read claims

    Check the user id, roles and tenant your auth provider put in the token.

  • Check the alg

    Spot alg none or an algorithm your server does not expect.

  • Agent tokens

    Confirm how long a token lasts before you hand it to a long-running agent.

Set up once

Three steps. Your agent does the rest.

Keep going

More free tools

FAQ

Questions about jwt decoder

The token is decoded by code on this page and is not sent to looot or anyone else. Still, treat a live token like a password: anyone holding it can use it until it expires. Prefer an expired or test token when you can.

No. Verifying needs the signing secret or the public key, and a secret should never be typed into a web page. Verify on your server with your JWT library, and pin the alg, iss and aud you expect.

A JWT is three Base64URL parts joined by dots: header, payload and signature. Decode the first two and parse them as JSON. This page does that as you type.

Read the exp claim, a Unix time in seconds, and compare it with the current time. The page shows exp as a UTC date and says how long until or since it passed.

iat is when the token was issued, nbf is the earliest time it may be used and exp is when it stops being valid. All three are Unix times in seconds.

A signed JWT is encoded, not encrypted. The signature stops changes, not reading. Keep secrets out of the payload, or use an encrypted token (JWE).

No. A JWE has five parts and its payload needs the key to read. The page says so when it sees five parts.

Yes. Paste the whole Authorization header value and the page drops the Bearer prefix and any line breaks.
For agents
tool
JWT decoder
category
Converters
input
A JSON Web Token
output
header JSON, payload JSON, issued, not before and expiry times, expired or not, warnings such as alg none
price
per call, read live from the catalog on the web page
web tool
runs in the visitor's browser, no API call, free and unlimited
schedule
on demand
setup
https://looot.ai/skill.md
llms.txt
https://looot.ai/llms.txt
updated
2026-10-14
markdown /free-tools/jwt-decoder.md

Run jwt decoder from your own agent.

Start your workspace, top up, and paste the prompt into the agent you already use. It runs the job with live data and shows the cost first.

Start your workspace See all free tools