What you will see
The header says how the token was signed (for example HS256). The payload lists the claims. If the token has an exp claim, the tool tells you whether it is still valid or has expired, and when.
Good to know
A JWT is signed, not encrypted. Do not put secrets in the payload. To work with the pieces by hand, use the Base64 decoder with the URL-safe option, or convert timestamps with the Unix timestamp converter.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact string with three parts separated by dots: a header, a payload with claims such as the user id and expiry time, and a signature. The first two parts are just Base64URL text, which is why anyone can read them.
Does this tool verify the signature?
No. Verifying needs the secret or public key, which should never be pasted into a website. This tool only decodes, so a decoded token is not proof the token is genuine.
What do exp, iat and nbf mean?
exp is the expiry time, iat is when the token was issued and nbf is the time before which it must not be accepted. They are Unix timestamps in seconds, and the tool converts them to dates.
Is it safe to paste a real token here?
Decoding happens in your browser and nothing is sent, but treat live tokens like passwords. Prefer test tokens, and revoke any real token you have shared.