JWT decoder
The signature is shown but never verified, that needs the signing key, which this page does not have and should not ask for.
Processed in your browser · nothing is uploaded
Splits a JWT into its three parts and decodes the header and payload, showing the expiry in readable form. The signature is displayed but not verified.
How to use the jwt decoder
Not verifying is the honest position for a browser tool: verification needs the signing key, and pasting a production signing key into a web page is precisely the mistake nobody should make. That leads to the thing worth understanding about JWTs. A decoded payload proves nothing. Anyone can craft a token with any claims in it; only the signature makes it trustworthy, and only your server can check that. Two related habits: never put anything secret in a payload, because it is merely Base64 and readable by anyone holding the token, and treat a token seen in a URL or a log as compromised.
Questions
No, deliberately. Verification needs the signing key, which should never be pasted into a web page.
No. The header and payload are Base64 and readable by anyone with the token. Never put secrets in a payload.
Expiry and issued-at, both Unix timestamps in seconds. The expiry is shown here in readable form.
No, it is decoded entirely in the page. Even so, treat any token you have pasted anywhere as worth rotating.
Header, payload and signature, joined by dots and each Base64URL encoded.