What a JWT is made of
A JSON Web Token is three base64url segments joined by dots:
header.payload.signature. The header names the signing algorithm, the payload
carries the claims, and the signature covers the first two. The first two parts
are encoded, not encrypted — anyone holding the token can read them, which
is why a JWT should never carry a secret.
How to use it
Paste the token. The header and payload appear as formatted JSON, and any time-based claim is shown both as an ISO timestamp and in your local timezone, with an expired token flagged in the status bar.
The claims worth checking
| Claim | Meaning | What usually goes wrong |
| --- | --- | --- |
| exp | Expiry, in seconds | Confused with milliseconds, giving a 1970 date |
| iat | Issued at | Clock skew between services makes a fresh token look future-dated |
| nbf | Not valid before | Silently rejects a token that otherwise looks fine |
| aud | Intended audience | A token valid for another service is accepted because nobody checks |
| alg | Signing algorithm | none, or an RS256 token verified as HS256 |
Decoding is not validating
This page answers "what does this token say". It cannot answer "should I trust it" — that requires the key, a clock, and a policy about audience and issuer, all of which belong on your server. Use this to debug what you are sending; keep verification where the secret lives.
Questions
Does this verify the signature?+
No, deliberately. Verifying HS256 needs the shared secret and verifying RS256 needs the public key. Pasting a signing secret into a web page is precisely the mistake this tool is built to avoid. Decoding tells you what a token claims; only your own backend should decide whether to believe it.
Is my token sent to a server?+
No. The token is split and Base64-decoded in this tab. You can open the network panel and confirm that nothing leaves the page. That is the whole reason to use a local decoder for a credential.
Why is exp a big number instead of a date?+
RFC 7519 defines exp, iat and nbf as seconds since 1970, while JavaScript's Date works in milliseconds. Passing the raw value to new Date() gives you a date in 1970, which is the classic off-by-1000 bug. This tool multiplies correctly and shows both the ISO value and your local time.
The token says alg: none — is that a problem?+
Yes. An unsigned token can be edited by anyone. Any library that accepts alg: none without an explicit opt-in has a known vulnerability; if you see this on a real token, treat it as a finding rather than a curiosity.