JWT Decoder (expiry in KST)

Paste a JWT to see its header and payload as colored JSON, with exp, iat and nbf converted to UTC and Korea Standard Time plus the time left before expiry. Can also verify HS256, HS384 and HS512 signatures.

How to use

  1. Paste the JWT into the box. A leading Bearer or line breaks are fine.
  2. The header and payload are decoded to JSON, and exp, nbf and iat are shown in Korea time. The badge says whether the token has expired and how long is left.
  3. To check the signature of an HS256, HS384 or HS512 token, enter the secret and choose its format (text or base64url).
  4. Use the copy buttons to take the header or payload.

FAQ

What does the exp value mean?

It is a NumericDate: seconds since 1970-01-01 00:00:00 UTC (RFC 7519). For example, 1300819380 is 2011-03-22 18:43:00 UTC, or 2011-03-23 03:43:00 in Korea (UTC+9). The tool shows both.

Which signatures can be verified?

Only HMAC tokens with a shared secret: HS256, HS384 and HS512. Tokens signed with a key pair, such as RS256 or ES256, can still be decoded and have their times converted, but not verified.

Is decoding without verifying safe?

Reading is fine, but decoded claims cannot be trusted until the signature is checked, because anyone can edit a payload and re-encode it. A server that authenticates users must always verify the signature.

What does the alg none warning mean?

The token carries no signature. If a server accepts such tokens, anyone can write any claims they like, so the tool flags it.

Why won't a token with five parts decode?

Five parts means an encrypted JWE. It needs the decryption key to be read, so only signed JWTs with three parts are supported.

Is it safe to put secrets in the payload?

No. The header and payload are only base64url-encoded, not encrypted, so anyone holding the token can read them. Before pasting a live token or secret, make sure it has been revoked or has expired.

AI agents: this calculation is available over an API without the form — see /llms.txt and the tool list at /api/calc; confirm the final result on this page.

Related tools

Character & Byte Counter (Korean NEIS, Resumes)

Paste text to get character counts with and without spaces, plus byte counts under three rules side by side: NEIS (Korean school records), UTF-8 and EUC-KR (job-site style). Enter a limit such as 1500 bytes or 500 characters to see what is left or where you went over. The limits are editable.

Cron Expression Parser: Next Run Times in KST and UTC

Explains a 5-field cron expression and lists the next 10 run times in Korea Standard Time (KST) and UTC, with the equivalent expression for a server running on UTC.

Subnet & CIDR Calculator

Enter an IPv4 address with a prefix length (/24) or subnet mask to get the network and broadcast addresses, usable IP range and host count, with binary working and a subnet split table.

Unix Timestamp Converter (KST)

Convert a Unix timestamp (epoch time) to Korea Standard Time (KST) and UTC, or a KST date back to seconds and milliseconds. It tells seconds from milliseconds by digit count and shows the current timestamp live.