What is a JWT?
A JSON Web Token (JWT, RFC 7519) is a compact, URL-safe way to represent claims between two parties. It consists of three base64url-encoded, dot-separated parts: a header (algorithm and token type), a payload (the actual claims — user ID, expiry, roles, etc.), and a signature (proves the token wasn't tampered with, if you have the key to check it).
Why this tool doesn't verify signatures
Verifying a signature requires the same secret (for HMAC algorithms like HS256) or the issuer's public key (for RSA/ECDSA algorithms like RS256/ES256) that was used to sign the token — something most people pasting a token here won't have on hand, and something this tool has no way to know is genuinely correct even if you did supply it. Decoding a token's contents and verifying its authenticity are two different operations; this tool only does the first. Never trust a token's claims as authentic without verifying its signature server-side, using the actual issuer's key.
Common claims
exp— expiration time (Unix timestamp, seconds). The token should be rejected after this time.iat— issued-at time.nbf— not-before time; the token isn't valid until this time.sub— subject, typically a user ID.iss— issuer, who created the token.aud— audience, who the token is intended for.
Frequently asked questions
Is it safe to paste a production JWT into this tool?
Decoding happens entirely in your browser — the token is never sent to a server. That said, JWT payloads are only base64-encoded, not encrypted, so anyone who has the token can already read its contents (with or without this tool). Treat any JWT with the same care as a password if it grants access to something sensitive, and avoid pasting tokens from systems you don't control into any third-party site as a general practice.
Why does the payload look readable — isn't a JWT supposed to be secure?
A JWT's signature protects its integrity (proving it wasn't tampered with) — it does not encrypt the contents. The header and payload are just base64url-encoded JSON, readable by anyone. If you need to hide the claims themselves, use a JWE (JSON Web Encryption) or encrypt the payload separately.
What does "expired" mean here?
This tool compares the token's exp claim (if present) against your browser's current time and flags it if that time has passed. It's purely informational — an application enforcing token expiry does the same check server-side, independent of this tool.
Will this decode a token from jsonwebtoken, jwt-decode, or python-jose?
Yes — JWT is a standard format (RFC 7519) regardless of which library signed it. Tokens produced by Node's jsonwebtoken, decoded client-side by jwt-decode, or issued by Python's python-jose are all structurally identical header.payload.signature tokens, and this tool decodes any of them the same way.