Regex Tester
Test patterns and inspect every capture group.
Never uploadedRead the header and claims of a token. Decoded locally, never sent anywhere.
All three dot-separated parts. Decoding happens in your browser.
Both are shown as formatted JSON, with the algorithm called out.
Issued-at and expiry are converted to readable dates, and expired tokens are marked.
No, and no browser tool honestly can without your secret or public key. This decodes and displays the token so you can read the claims. Verification has to happen server-side where the key lives.
Safer than most alternatives, because decoding happens locally and nothing is sent or logged. That said, a JWT is a live credential until it expires - if you have pasted one into any online tool, treat it as exposed and rotate it.
Issued-at and expiry, both Unix timestamps in seconds. They're shown as readable dates here, and an expired token is flagged.
Header, payload and signature, joined with dots and each Base64url-encoded. Only the first two carry readable JSON; the third is the cryptographic proof.
Decode a JSON Web Token and read its header and claims without sending it anywhere. The three dot-separated parts are Base64url-encoded header, payload and signature; only the first two contain readable JSON, and this tool formats both, converts the iat and exp timestamps into readable dates, and flags a token that has already expired. It does not verify the signature - no browser tool can do that honestly without your key, and verification belongs on the server. Treat any token you paste into an online tool as exposed.
The last couple are from other categories - there are 81 tools here in total.
Test patterns and inspect every capture group.
Never uploadedFormat, validate and minify JSON instantly.
Never uploadedEncode or decode Base64, UTF-8 safe.
Never uploadedRandom v4 UUIDs, as many as you need.
Never uploadedMonthly payment with tax and insurance included.
Never uploadedGitHub-flavoured markdown to clean HTML.
Never uploaded