What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format made of three Base64URL-encoded parts — header, payload, and signature — separated by dots, commonly used for authentication and information exchange.

Does this tool verify the token's signature?

No. This tool only decodes the header and payload so you can read their contents; it does not check the signature against a secret or public key. The notes under the input box and next to the signature say the same.

What do the exp, iat, and nbf claims mean?

iat is when the token was issued, nbf is the earliest time it becomes valid, and exp is when it expires. All three are Unix timestamps (seconds since 1970), which this tool converts into a readable date.

Is it safe to paste a real production token here?

Yes, in the sense that decoding happens entirely in your browser and the token is never sent anywhere — but treat any real token as a secret regardless of where you paste it, since anyone who has it can potentially use it until it expires.

Why can't I read the signature part?

The signature isn't meant to be human-readable — it's a cryptographic value used to verify the token wasn't tampered with. This tool shows it as raw text but doesn't attempt to decode or verify it.

Why does my token say “Not expired” but my API still rejects it?

The badge only compares the exp claim with your device’s clock. A server can still reject the token if the signature doesn’t match its key, the aud or iss claim is wrong, nbf is still in the future, the token was revoked, or the server’s clock differs from yours.