JWT Decoder

Decode and inspect a JSON Web Token's header, payload and claims with humanized expiry.

A JSON Web Token is three Base64url segments joined by dots: a header saying which algorithm signed it, a payload of claims, and the signature. The first two are encoded, not encrypted, which is the single most misunderstood thing about the format — anyone holding a token can read everything in its payload without any key at all.

That is exactly why decoding is not verifying. This shows you what a token says; it cannot tell you whether the signature is valid, and only your server holding the key can. Never put anything in a payload you would not be comfortable handing to whoever ends up with the token.

The time claims trip people up because they are Unix seconds, not milliseconds — `exp` is expiry, `iat` is issued-at, and `nbf` is a not-before time that makes a token invalid until it arrives. A token that "expires immediately" is very often a millisecond value in a seconds field, off by a factor of a thousand.