Paste a JWT to see its header and claims. Expiry and issue times are converted to readable dates, and registered claims are explained. The token stays in your browser.
Runs entirely in your browser. This page is a static file. Whatever you type stays in the tab, is never sent to a server, and is gone when you close it — so pasting a real token or config is safe.
Header, payload and signature, separated by dots.
exp is seconds since the Unix epoch, not milliseconds. A value in milliseconds lands in the year 55000 and is a common bug.
Libraries that honour alg: none accept forged tokens. Always pin the expected algorithm on the server.
A JWT is signed, not encrypted. Anyone holding the token can read every claim, exactly as this page does. Never put anything confidential in it.
Decoding proves nothing about authenticity. A token can be perfectly readable and completely forged; only signature verification on your server settles it.
If a token expires "immediately", compare the iat claim with your server clock. A few minutes of drift between machines rejects otherwise valid tokens.
No. The page is static and decoding happens in your browser with a Base64 and JSON parse. Nothing is logged or transmitted, which you can confirm in the network panel.
Verification requires the signing secret or the issuer's public key. Pasting a production signing secret into a web page would be a far worse habit than any convenience it buys.
exp is when the token stops being accepted; nbf is when it starts. A token issued in advance can have an nbf in the future, and will be rejected until then.