JWT Decoder
- Claim dates
- Expiry check
- No secret
Decode a token's header and claims, with timestamps and expiry made readable.
About jwt decoder
A JWT decoder reads the header and payload of a JSON Web Token without verifying its signature. JSONic renders the exp, iat and nbf claims as readable dates and flags expired tokens. Verification is deliberately omitted, because it requires your signing secret, which should never be pasted into a web form.
Paste a JSON Web Token to read its header and payload. Registered time claims — exp, iat, nbf — are rendered as ISO timestamps with a relative description, and an expired token is flagged. Decoding is deliberate: this tool does not verify the signature, because verification needs your signing secret and pasting a production secret into a web form is a habit worth not forming. Verify in your own code, where the key already lives.
Questions
Why does this not verify the signature?
Verification requires the signing key. Asking for a production secret in a browser form normalises a genuinely bad practice, whatever the page promises about staying client-side. Decode here to read the claims; verify in your service, where the key belongs.
Is the token sent anywhere?
No. It is split and base64url-decoded in your browser. That said, a JWT is a credential — treat one pasted anywhere as potentially compromised, and prefer expired or test tokens when debugging.
What do exp, iat and nbf mean?
Expiry, issued-at and not-before, all as seconds since the Unix epoch — not milliseconds, which is the most common source of tokens that appear to expire in 1970 or in the year 55000.