How to use it
Paste a token into the “Paste a JWT” box and you get five things back.
- Expiry notice: if the payload has an exp, the top of the results says “Not expired” or “Expired” along with the exp time. This notice compares exp with the device clock only; it does not confirm the nbf start time or verify the signature.
- Header, Payload: each part as indented JSON. The button next to each heading copies that part on its own.
- Signing algorithm: the alg value from the header. If alg is missing or isn’t a string, this reads “Not shown”.
- Signature (raw, not verified): the third segment, shown exactly as it came in.
- Registered claims: exp (expires at), iat (issued at) and nbf (not valid before), converted to a date and time. Any of the three that the payload doesn’t have shows “Not present”.
Dates and times use this browser’s time zone. If your server logs are in UTC, expect them to differ by your UTC offset.
A worked example
Paste in the token below.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQyIiwiaWF0IjoxNzY3MjI1NjAwLCJleHAiOjE3NjcyMjkyMDB9.c2lnbmF0dXJl- Header comes out as
{"alg": "HS256", "typ": "JWT"}, and Signing algorithm as HS256. - Payload is
{"sub": "user-42", "iat": 1767225600, "exp": 1767229200}. - The iat, 1767225600, is January 1, 2026, 00:00:00 UTC. The exp, 1767229200, is one hour later at 01:00:00 UTC. A browser set to a UTC+9 time zone shows them as 9:00:00 AM and 10:00:00 AM. Both are in the past, so the notice at the top says “Expired”.
- The third segment,
c2lnbmF0dXJl, is not a real signature. It is just the word signature written in Base64URL. The token decodes without a single error anyway, which shows that this tool doesn’t check the signature at all.
The three parts of a JWT
A JWT is three segments separated by dots: header.payload.signature. The header names the signing algorithm (alg) and the token type (typ). The payload carries claims such as a user ID, permissions and an expiry time. A claim is simply one name and value pair inside the token.
The header and payload are JSON written out in Base64URL. They are not encrypted. Anyone holding the token can read it without a key. Paste a token that contains an email address or internal permissions into a chat app or an issue tracker and you have published those details too. Only the last segment, the signature, is produced with the issuer’s key. It is used to check that the header and payload haven’t been altered since the token was issued.
What this tool does not check
- The signature: verifying it takes the issuer’s secret key (for the HMAC family) or public key (for RSA and ECDSA), and this tool has no field for a key. A token whose contents look fine is not necessarily genuine.
- Whose clock decides expiry: “Not expired” and “Expired” come from a comparison with this device’s clock. If the device clock is wrong, so is the verdict.
- Leeway: the status turns to “Expired” the instant the current time reaches exp, and reads “Before start time” for any time before nbf. RFC 7519 allows a small leeway, usually no more than a few minutes, to cover clock differences between servers. This tool allows none, so a token your server still accepts can show up as expired here.
- Other claims: values such as iss (issuer) and aud (audience) simply appear in the Payload. Nothing checks whether they are the right ones.
What actually grants or denies access is the server’s own verification. A production token works like a key card for as long as it is valid, so follow the warning on the page and keep it out of online tools.
Reading exp, iat and nbf values
RFC 7519 says these three claims hold the number of seconds since January 1, 1970, 00:00:00 UTC. The format is called NumericDate. This tool converts a value to a date only when it is a number.
- A string in quotes, such as
"exp": "1767229200", is not read as a date and shows “Not present”. The raw value is still visible in the Payload JSON, so if a claim is clearly there but reads “Not present”, look for quotes. - A number too large for a JavaScript date also shows “Not present”.
- Only exp and nbf get a status. For iat you get the time and nothing more.
When a token won’t decode
| Error on the page | Usual cause |
|---|---|
| A JWT must have three dot-separated parts (header.payload.signature), but this has N. | Only part of the token was copied. Encrypted tokens (JWE) have five segments and can’t be read with this tool |
| The header (or payload) part couldn’t be read as Base64URL. | A leading “Bearer “, a line break in the middle, or standard Base64 containing +, / or = |
| The header (or payload) part decoded, but it isn’t valid JSON. | Some other values joined with dots that aren’t a JWT |
Base64URL is Base64 with + and / swapped for - and _ and the trailing = dropped. This tool refuses anything that contains characters other than A–Z, a–z, 0–9, - and _.