What this tool does
A JSON Web Token is three Base64URL segments separated by dots. Anyone can read the header and claims; the signature only proves who issued it. This decoder shows the readable parts and flags exp, iat and nbf against your clock. It does not verify signatures — that requires the issuer's key and belongs on a server.
How to use it
- Paste the token.
- Inspect the decoded header, payload and time claims.
- Copy the payload if you need it.
Questions
Does it verify the signature?
No. Verification needs the issuer's public key or secret and must happen server-side. This tool only decodes.
Is it safe to paste production tokens?
Avoid real secrets. Tokens are displayed in the page and could be visible to browser extensions or someone looking at your screen. Use test tokens.
Why is my token invalid?
A JWT needs three dot-separated Base64URL segments whose first two decode to JSON. Encrypted JWE tokens are not readable this way.