How to use it
Paste the token
From an Authorization: Bearer … header or your dev tools; the word Bearer is removed for you.
Read the claims
Header and payload are formatted, and dates like exp are shown with the time left.
Verify
Enter the secret (HS256) or public key (RS256 and others) to confirm the token wasn’t changed.
Common claims
| Claim | Meaning |
|---|---|
exp | Expiry time (seconds since 1970) |
iat | Issued at |
nbf | Not valid before |
sub | Subject, usually the user ID |
iss | Issuer |
aud | Intended audience |
jti | Unique token ID |
Good to know
A JWT isn’t encrypted. The payload is only Base64URL-encoded; anyone with the token can read it. Never put passwords or secrets in it.
The signature prevents tampering. It proves the content hasn’t changed since the server issued it; it doesn’t hide it.
Beware alg: none. An unsigned token must always be rejected by servers; we warn you when we see one.
FAQ
Is it safe to paste my token here?
Yes. Decoding and verification happen entirely in your browser; the token and key are never sent to any server. Still, a live token works like a temporary password, so don’t share it.
How do I know if a token has expired?
From exp: we show it as a date and time in UTC and your local time, with “expired … ago” or “expires in …”.
Why “invalid signature”?
Either the key isn’t the one the server signed with (check the Base64 option for secrets), or the header or payload was changed after signing.
Where do I get the public key?
Usually from the issuer’s JWKS URL, like /.well-known/jwks.json. Paste the whole thing and we pick the key by kid.