New in Toolbox 1.1
Decode a JWT on your Mac
Paste a JSON Web Token and JWT Decoder shows its header and payload as formatted JSON, explains each registered claim and turns times like exp and iat into dates in your time zone, with how long the token has left. For HS256, HS384 and HS512 tokens you can check the signature with the shared secret. Tokens never leave your Mac, which matters because a live token often grants access.
How to use JWT Decoder
Open JWT Decoder and paste the token. A Bearer prefix and quotes are fine.
Read the header and the claims, with expiry and issue times shown in your time zone.
For an HMAC token, paste the secret to verify the signature. Turn on Base64 if the secret is Base64-encoded.
Click Copy Payload, or copy any single part.
Questions about JWT Decoder
How do I decode a JWT without pasting it into a website?
Paste it into JWT Decoder in Toolbox. The token is decoded on your Mac, so a live access token is never sent to a third-party site.
Does decoding a JWT verify it?
No. Anyone can decode a JWT's header and payload. JWT Decoder verifies HS256, HS384 and HS512 signatures with the shared secret. Tokens signed with RS256, ES256 and other public-key algorithms are decoded but not verified, and for an encrypted token only the header can be read.
How do I see when a JWT expires?
JWT Decoder reads the exp claim and shows the date and time in your time zone, plus how long until the token expires or how long ago it did.
Is it free, and is my token uploaded?
Toolbox is a paid app, and one purchase includes every tool, with no subscription or account. Tokens and secrets are decoded and checked on your Mac and never sent anywhere.
Related tools
- Base64Encode and decode Base64 text and files, with URL-safe and line-wrap options.
- JSON FormatterPretty-print, minify and validate JSON, with the line and column of any mistake.
- Timestamp ConverterTurn Unix timestamps into dates and back, in seconds, milliseconds or microseconds, in any time zone.
- Hash GeneratorMD5, SHA-1 and SHA-2 checksums of text or files of any size, and check them against an expected hash.
