Decode a three-part JWT to inspect its header, payload and encoded signature. Time labels help you read expiry claims, but this tool never authenticates the token or verifies its signature.
lightbulb When to use this tool
- check_circle Inspect a test token’s claim names while debugging an integration.
- check_circle Read an expiry timestamp and compare it with your expected issuer settings.
Inputs and results
Input: A three-part token string.
Output: Header/payload, timestamp hints and signature text.
How it works
Paste a test JWT with header, payload and signature parts separated by dots.
Read the decoded header and payload. Check that the issuer, audience and time claims match what you expected.
Copy a section if needed. Use a trusted JWT verification library and issuer key before accepting a token in an application.
Examples
science Expired claim
A payload containing {"exp":0} is expired because its stated expiry is the Unix epoch. This says nothing about whether its signature was ever valid.
science A future expiry is not proof of validity
A token can contain a future exp value and an invented signature. The “Not expired (time only)” badge describes the timestamp only; the token still requires signature, issuer and audience validation.
Limitations
No signature, issuer, audience or permission verification. An unexpired badge checks time only, not authenticity.
Frequently Asked Questions
Does decoding verify a JWT signature? expand_more
Does “Not expired” mean the token is valid? expand_more
Should I paste a production access token? expand_more
Processing & Privacy
Processing uses your browser rather than uploading the supplied input to a processing server. Fonts and tool libraries can make third-party network requests. Optional analytics loads after consent. See the Privacy Policy for site-wide details.