JWT Decoder — decode header and payload, check expiry, verify HS256 signatures

Paste a JWT to decode its header and payload, read exp and iat as dates, and verify HS256/384/512 signatures with your secret. Nothing leaves your browser.

{}JSON Formatter .*Regex Tester */5Cron Expression eyJJWT Decoder b64Base64 & URL Encoding UTCTimestamp Converter #Hash Generator

JSON Formatter & Validator

Paste JSON and it is checked right away, with any error pinned to its line and column. It pretty-prints, minifies to one line, converts to YAML and shows a tree view — and keeps big numbers and key order exactly as written.

Sort keys

Input

Result

Paste JSON on the left and the result appears here. First time? Try the "Example" button above.

Waiting for input.

Regex Tester

Enter a pattern and flags to color every match in the test string and see capture groups and the replacement result. It runs as-is on your browser's JavaScript regex engine.

Common patterns

/ /g

g global i ignore case m multiline s dot matches newline u unicode y sticky

Test string

Enter a pattern.

Matches

No matches.

Replace

$1, $2 insert numbered groups, $<name> a named group and $& the whole match. Leave it empty to skip replacing.

Cron Expression Explainer

Turns a cron expression into a readable sentence and works out the next five run times in the time zone you pick. Standard five-field crontab: minute, hour, day of month, month, day of week.

Expression

Field by field

Next run times Time zone

Server cron jobs usually run in the server's time zone. GitHub Actions schedules and many cloud schedulers use UTC, so convert your local time to UTC first (for Korea, subtract nine hours).

JWT Decoder

Paste a JWT to decode its header and payload and turn the expiry (exp), issued-at (iat) and not-before (nbf) times into dates. HS256, HS384 and HS512 signatures can be verified with the secret; the token and key never leave this browser.

Token

Waiting for a token.

Header

Payload

Time claims

No exp, iat or nbf claims.

Verify signature (HS256, HS384, HS512)

Secret is Base64-encoded Show key

Enter the secret to verify the signature.

Base64 & URL Encoding

Turn text or files into Base64 and Base64 back into text. URL-safe alphabets, missing padding and data: URLs are all read. URL (percent) encoding happens here too, always in UTF-8.

URL-safe (- _ and no =) Files as a data: URL Choose file Whole URL (keep : / ? # &) + as space (form data)

Input

Result

Waiting for input.

Unix Timestamp Converter

Convert Unix timestamps to dates and dates to timestamps. Seconds, milliseconds, microseconds and nanoseconds are told apart by digit count, and dates without a time zone are read in the zone you pick.

Now

seconds milliseconds

Timestamp or date Time zone

Enter a timestamp or a date.

Results

A date without a time zone (e.g. 2026-09-24 09:30) is read in the zone selected above. A trailing Z or +09:00 sets the zone explicitly. Click a value to copy it.

Hash Generator

Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for text or a file in one go. Paste a hash you were given to see which one it matches. Files are hashed in this browser, never uploaded.

Drop a file here or click to choose

Waiting for input.

MD5 and SHA-1 have known collision attacks, so never use them for security such as signatures or passwords. To check that a download matches the original, use SHA-256. Click a value to copy it.

FAQ

Is the JSON or test text I paste sent to a server?

No. Checking, converting, matching and calculating all happen inside this browser, and nothing you enter is sent anywhere or stored. It is fine to paste sensitive content such as API responses or config files. Only view settings like the last tab you opened and the indent size are remembered in this browser.

Does formatting change my numbers or key order?

No. This formatter reads JSON itself instead of going through JavaScript's JSON.parse, so integers larger than 2^53 (Twitter or Discord IDs, for example) and number spellings like 1.0 stay exactly as written. Numeric keys such as "10" and "2" are not pulled to the front either. If the same key appears twice, both are kept and a warning tells you.

Does it accept JSON with comments or trailing commas?

Standard JSON does not allow comments, a comma after the last item or single-quoted strings, so they are shown as errors. Because these are common slips, the message says exactly what is wrong — "A trailing comma is left" or "Single quotes are not allowed" — and where, so you only need to fix that spot.

Which regex flavor does it use?

It runs directly on your browser's JavaScript (ECMAScript) regex engine. Named groups, lookbehind and Unicode properties (such as \p{L} with the u flag) are available. Syntax found only in PCRE or Python — possessive quantifiers, atomic groups, \A and \Z — is not supported, so if the pattern is meant for another language, check how its syntax differs.

What does "Did not finish within 1.5 seconds" mean?

Patterns with nested quantifiers such as (a+)+$ can backtrack through an explosive number of possibilities on input that does not match, freezing for minutes (catastrophic backtracking). This page runs the regex on a separate worker thread and stops it after 1.5 seconds, so the screen never freezes. If you see this message, the same input could hang a real server too — untangle the nested quantifiers.

What happens if I set both day of month and day of week?

In standard crontab, if neither field is an asterisk the job runs when either one matches. For example, 0 9 1 * 1 runs at 9 AM on the 1st of every month and also every Monday. For day of week, 0 and 7 are both Sunday, and English abbreviations like MON and JAN work. The six-field format with seconds (Quartz, Spring) and extensions such as L, W and # are not supported.

Is it safe to enter my JWT secret?

The token and key are never sent to a server; the signature is computed only with the browser's built-in Web Crypto and nothing is stored. Still, as a rule, never paste a production secret into any web tool — use a development or test key. Tokens verified with a public key, like RS256 or ES256, are decoded only. Remember too that a JWT payload is encoding, not encryption: anyone can read it.

Can I store passwords with MD5 or SHA-256?

No. For MD5 and SHA-1 there are known ways to make two inputs with the same hash, and SHA-256 is so fast that short values like passwords fall quickly to brute force. Store passwords with a deliberately slow function such as bcrypt, scrypt or Argon2, plus a salt. Use the hashes here to check that a downloaded file matches the original.

How do you tell seconds from milliseconds?

By the number of digits. For the present day, seconds have 10 digits, milliseconds 13, microseconds 16 and nanoseconds 19. So up to 11 digits is read as seconds, up to 14 as milliseconds, up to 17 as microseconds and anything longer as nanoseconds, and the result says which it used. JavaScript's Date.now() is in milliseconds; the Unix command date +%s and most server languages use seconds.

See all questions

JWT Decoder — decode header and payload, check expiry, verify HS256 signatures

JSON Formatter & Validator

Regex Tester

Cron Expression Explainer

JWT Decoder

Base64 & URL Encoding

Unix Timestamp Converter

Hash Generator

Related tools