What this tool does and does not do
A JWT in compact form has three base64url-encoded parts separated by dots: header.payload.signature. This tool decodes the first two and displays them. It does not verify the signature, so it cannot tell you whether the token was issued by who it claims, or whether its contents were changed. Anyone can create a token with any claims; only verification with the correct key establishes trust.
The expiry message compares exp and nbf with your device clock. It is useful for debugging "token expired" errors, but it is not a security check. Read JWT decoding vs. signature verification for the details.
Registered claims
| Claim | Name | Notes |
|---|---|---|
iss | Issuer | Who created and signed the token. |
sub | Subject | Who the token is about, usually a user ID. |
aud | Audience | Who the token is intended for. Servers should reject tokens for other audiences. |
exp | Expiration time | Seconds since the Unix epoch, not milliseconds. |
nbf | Not before | The token must not be accepted before this time. |
iat | Issued at | When the token was created. |
jti | JWT ID | A unique identifier, often used to prevent replay. |
These names come from RFC 7519. Time claims are NumericDate values in seconds; to convert one by hand, use the Unix timestamp converter.
Warnings you may see
"alg": "none"— the token is unsigned. Accepting such tokens has caused real authentication bypasses; servers should only accept the algorithms they expect.- Five segments — this is an encrypted token (JWE). Its payload cannot be read without the decryption key, so this tool does not attempt it.
- Payload is not JSON — legal for generic JWS, but unusual for a JWT. The raw text is shown.
Decoding a JWT in code
// JavaScript (browser or Node 16+) – decode only, no verification
const [, payload] = token.split(".");
const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
console.log(JSON.parse(new TextDecoder().decode(
Uint8Array.from(json, (c) => c.charCodeAt(0)))));
# Shell (GNU coreutils; add "=" padding if base64 complains)
echo "$TOKEN" | cut -d. -f2 | tr '_-' '/+' | base64 -dTo verify a token, use a maintained library for your platform (for example jose for JavaScript or PyJWT for Python) with an explicit list of allowed algorithms.