JWT Decoder
Header
—
Payload
—
Key claims
| alg | — |
| typ | — |
| iss | — |
| sub | — |
| iat | — |
| nbf | — |
| exp | — |
| Status | — |
This only decodes. It does not verify the signature - that needs the issuer key, which no web page can check for you.
About JWT Decoder
Paste a token and you get the header and payload back, with iat, exp and nbf turned into readable times and a verdict on whether it has expired.
Decoding only, no signature check. Whether the signature holds depends on the issuer's key, and no web page can decide that for you. A "not expired" label means the time fields still line up, not that the token is genuine.
Worth repeating: a JWT payload is base64 encoded, not encrypted. Anyone holding the token can read it, so passwords, ID numbers and anything else sensitive do not belong in there.
Frequently asked questions
How do I verify the signature?
On the server, with the issuer's key or public key. It cannot be done in a browser, and the key should never be shipped to one.
It says expired but the API still works.
Either the server does not check exp, or your clock is off. Compare system time first.
The output is garbage.
The token was probably truncated or copied with a line break. All three parts have to be intact.
