Does this verify the JWT signature?

No, and nothing that decodes a token in a browser can. Verification needs the signing key, which is a server-side secret. This tool reads the header and payload and tells you what the token claims — treat every claim as unverified until your backend has checked the signature.

Is it safe to paste a real token here?

Decoding happens entirely in this tab, so the token is not transmitted. That said, a JWT you paste anywhere is a bearer credential: if it is a live production token, rotate it rather than relying on any tool's promise.

What do exp, iat and nbf mean?

They are Unix timestamps in seconds. exp is when the token expires, iat is when it was issued, and nbf is the earliest time it may be accepted. This tool converts all three to readable dates and tells you whether the token is currently within its window.

JWT Decoder

Read the header, payload and registered claims of a JWT. Decoding is not verification.

Decoding is not verification. Anyone can read a JWT — the payload is Base64, not encryption. A token that decodes cleanly may still be forged, replayed or expired. Only your server, holding the signing key, can say whether it is genuine.

Encoded token

Paste a JWT

header.payload.signature

Processed locally in your browser. Your token is decoded in this tab. It is never transmitted, logged or stored — including in local storage.

Reference

What a JWT is made of

A JSON Web Token is three Base64url-encoded segments joined by dots. The first is a header naming the signing algorithm, the second is the payload of claims, and the third is a signature over the first two. Only the signature is cryptographic — the header and payload are encoded, not encrypted, and anyone holding the token can read them.

That is the single most important thing to know about JWTs: never put anything in a payload that the bearer should not see.

Decoding is not verification

This tool reads the token. It does not check the signature, and it cannot: doing so needs the shared secret or the issuer's public key, and asking you to paste a signing secret into a web page would be worse advice than any convenience it buys.

A token that decodes successfully proves only that it is well-formed. Verification belongs in your backend, using a library that checks the signature, the algorithm against an allowlist, and the exp, nbf, iss and aud claims.

Registered claims

Claim	Meaning
iss	Issuer — who minted the token.
sub	Subject — who or what the token is about, usually a user id.
aud	Audience — the service the token is intended for. Reject tokens addressed elsewhere.
exp	Expiration time, in seconds since the Unix epoch. Past this, reject.
nbf	Not before — the token is invalid until this time.
iat	Issued at — when the token was created.
jti	A unique id for the token, used to detect replay.

All time claims are counted in seconds, not milliseconds. A token whose exp lands in the year 56000 usually means milliseconds were written by mistake.

The alg: none trap

The JWT specification permits an alg of none, meaning an unsigned token. Historically, several libraries accepted such tokens as valid, which let anyone forge one. Any verifier you write should pin the expected algorithm rather than trusting the value in the header.

Questions

Does this verify the JWT signature?: No, and nothing that decodes a token in a browser can. Verification needs the signing key, which is a server-side secret. This tool reads the header and payload and tells you what the token claims — treat every claim as unverified until your backend has checked the signature.
Is it safe to paste a real token here?: Decoding happens entirely in this tab, so the token is not transmitted. That said, a JWT you paste anywhere is a bearer credential: if it is a live production token, rotate it rather than relying on any tool's promise.
What do exp, iat and nbf mean?: They are Unix timestamps in seconds. exp is when the token expires, iat is when it was issued, and nbf is the earliest time it may be accepted. This tool converts all three to readable dates and tells you whether the token is currently within its window.