Read a JWT
Paste the token. Times are shown in this device’s zone. The signature is never checked.
Read JWTOn this device
A JWT is three Base64URL parts. This page decodes the first two as JSON and, when iat, nbf, or exp are numbers, shows them as local times. It does not hold a secret, it does not call a server, and it does not tell you the token is genuine.
How to use it
- Paste the whole token, including the dots.
- Read the header and the payload.
- If exp is in the past, the note says so. That still is not a signature check.
Good to know
- A token with no third part is still decoded, and the page says the signature is missing.
- Do not paste a live production token you would not want left in a tab.
- Nothing is uploaded, and nothing is stored after you clear the field.
Questions
Does this verify the signature?
No. Reading the payload is not proof the token was signed by anyone you trust.
Why say the token expired?
The exp number is earlier than this device’s clock. The signature was still not checked.