JWT Decoder

About

Paste a JSON Web Token and read its header and payload as formatted JSON. The exp, iat and nbf claims are shown as UTC and local dates, with whether the token has expired. Decoding happens in your browser: the token is never sent anywhere or stored.

Does it verify the signature?

No. It only decodes. Verifying needs the signing secret or public key, and pasting a secret into a web page defeats the point of having one. Treat anything shown here as unverified.

Is it safe to paste a real token?

The token isn't sent or saved; it only exists in this tab until you close it. Still, a live token is a password for as long as it's valid, so prefer an expired or test one when you can.

What do exp, iat and nbf mean?

exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. All three are Unix timestamps in seconds.

Why does it say my token has 5 parts?

A 5-part token is an encrypted JWE, not a signed JWT. Its payload is ciphertext and can't be read without the key.