How to use
- Paste a JWT (a leading “Bearer ” is fine).
- Header and payload are shown formatted.
- Times like exp and iat appear as dates with a “valid” or “expired” status.
Anatomy of a JWT
A JSON Web Token consists of three Base64URL-encoded parts separated by dots: header (algorithm), payload (claims such as user ID, roles, expiry) and signature.
Header and payload are only encoded, not encrypted – anyone can read them, so never store secrets in them. Only the signature ensures authenticity, and this tool doesn't verify it.
Frequently asked questions
Is it safe to paste my token here?
Yes. Decoding happens entirely in your browser and nothing is sent. Still, avoid copying production tokens around more than needed.
Is the signature verified?
No. That requires the secret or public key. The tool only shows the contents.
What do exp, iat and nbf mean?
exp = expiration time, iat = issued at, nbf = not before. All are Unix timestamps in seconds.