Does this verify the signature?

Yes — enter your HMAC secret or RSA/ECDSA public key in the Verify section. For HS* algorithms the secret is a plain text string; for RS*/ES* provide a PEM-formatted public key matching the private key that signed the token.

Is my token sent to a server?

The browser-side decoder never makes a network call — decoding is done entirely in JavaScript. The signature-verification call does send your token and key over HTTPS to a server-side endpoint, but neither is logged or stored.

How do I tell if a timestamp is in seconds or milliseconds?

Seconds timestamps for dates after 2001 are 10 digits (≥ 1,000,000,000). Milliseconds timestamps are 13 digits (≥ 1,000,000,000,000). This tool auto-detects: any number larger than 10,000,000,000 is treated as milliseconds.

What timezone does the output use?

All output is in UTC. Unix timestamps have no timezone — they always count seconds from the UTC epoch. The ISO 8601 string ends with 'Z' (Zulu / UTC). To display in a local timezone, use your application's date-formatting library with a timezone identifier (e.g. 'America/New_York').

Tool comparison

JWT Decoder vs Unix Timestamp Converter

JWT Decoder (encoding) and Unix Timestamp Converter (datetime) come from different categories but appear together in developer workflows. This guide explains what each does and when to reach for one over the other.

Bottom line

JWT Decoder exposes raw `iat`, `exp`, and `nbf` claims as Unix epoch integers. Timestamp Converter translates those integers into readable dates so you can immediately tell when a token was issued or when it expires. Use both together for authentication debugging.

What each tool does

JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe string used to securely transmit claims between two parties. It consists of three base64url-encoded segments separated by dots: a header, a payload, and a signature. The header specifies the signing algorithm (such as HS256, RS256, or ES256). The payload contains claims — statements about an entity and additional metadata, such as a user ID (sub), an expiry time (exp), an issuer (iss), and any custom application-defined fields. The signature is computed over the header and payload using a secret or private key, allowing the recipient to verify that the token was issued by a trusted source and has not been modified. JWTs are the standard mechanism for stateless authentication in modern web applications: once issued, they travel with every API request (typically in the Authorization: Bearer header) and can be validated without a database lookup. This tool decodes the header and payload instantly without requiring a key, and can optionally verify the signature using your HMAC secret or RSA/ECDSA public key — all within your browser.

Open JWT Decoder →

Unix Timestamp Converter

A Unix timestamp (also called epoch time or POSIX time) is the number of seconds that have elapsed since 00:00:00 UTC on 1 January 1970 — a moment known as the Unix epoch. Timestamps are the universal language of time in software: databases store them as integers, APIs return them in JSON, log files record them for every event, and JWT tokens use them for 'iat' (issued-at) and 'exp' (expiry) claims. Unlike formatted date strings, Unix timestamps are unambiguous — they have no timezone, no locale, and no format variation. JavaScript and many APIs also use millisecond timestamps (Unix seconds × 1000). This tool converts in both directions: paste a timestamp to get a human-readable date in UTC and ISO 8601, or paste a date string to get the corresponding epoch seconds and milliseconds.

Open Unix Timestamp Converter →

Side-by-side comparison

Feature	JWT Decoder	Unix Timestamp Converter
Category	encoding	datetime
Primary purpose	Decode and verify JSON Web Tokens — header, payload, claims, and signature.	Convert Unix timestamps to human-readable dates and ISO 8601, or convert dates back to epoch seconds.
Inputs	token, secret, algorithm	input, mode
Outputs	header, payload, signature, valid_structure, verified	unix_seconds, unix_ms, iso8601, utc, relative, valid, error

When to use each

Use JWT Decoder when…

How to decode a JWT in your browser

Instantly inspect the header and payload of any JWT without installing software.

How to inspect an Auth0 JWT token

Read the claims inside an Auth0 access token or ID token to debug permissions and user data.

Use Unix Timestamp Converter when…

How to convert a Unix timestamp to a readable date

Turn an epoch seconds value from a database, API, or log file into a human-readable date.

How to convert a date to a Unix timestamp

Get the Unix epoch seconds for a specific date to use in a database, API, or JWT.

Frequently asked questions

Does this verify the signature?: Yes — enter your HMAC secret or RSA/ECDSA public key in the Verify section. For HS* algorithms the secret is a plain text string; for RS*/ES* provide a PEM-formatted public key matching the private key that signed the token.
Is my token sent to a server?: The browser-side decoder never makes a network call — decoding is done entirely in JavaScript. The signature-verification call does send your token and key over HTTPS to a server-side endpoint, but neither is logged or stored.
How do I tell if a timestamp is in seconds or milliseconds?: Seconds timestamps for dates after 2001 are 10 digits (≥ 1,000,000,000). Milliseconds timestamps are 13 digits (≥ 1,000,000,000,000). This tool auto-detects: any number larger than 10,000,000,000 is treated as milliseconds.
What timezone does the output use?: All output is in UTC. Unix timestamps have no timezone — they always count seconds from the UTC epoch. The ISO 8601 string ends with 'Z' (Zulu / UTC). To display in a local timezone, use your application's date-formatting library with a timezone identifier (e.g. 'America/New_York').