JWT decoder and debugger
Decode a JWT to inspect its header and payload, and automatically check whether it has expired (exp) or is not yet active (nbf). Decoding happens entirely in your browser, which is handy for debugging a session without ever sending the token to a server.
⚠ Warning: the signature is NOT verified. This tool decodes the token's contents and only checks the exp/nbf dates declared in the payload. It in no way proves that the token is authentic or that it hasn't been tampered with: cryptographic signature verification must always be done on the server, using the issuer's secret or public key.
How it works
A JWT is made up of three parts separated by dots: header.payload.signature. The header and payload are Base64URL-encoded, not encrypted, so anyone can read them without a key. Beyond simple decoding, this tool reads the standard exp (expiration) and nbf (“not before”) claims and compares them with your device's current time, so you can see right away whether a server that follows the JWT standard would accept or reject the token based on that timing alone.
What exactly do exp and nbf mean?
exp (expiration) is a Unix timestamp after which the token must be considered expired. nbf (“not before”) is a timestamp before which the token must not yet be accepted, which is useful for tokens scheduled to become active later. Both are optional: if they're missing, the token itself imposes no time constraint of that kind.
The token looks valid here, so why does my API still reject it?
Because this tool only checks the structure and the declared dates, never the signature. An API can also reject a token for other reasons: an invalid signature, an incorrect issuer (iss) or audience (aud), a token revoked on the server side, or missing business claims. None of these checks is possible without access to the issuer's secret or public key, which always stays a server-side operation.
Privacy: decoding and date checks happen entirely in your browser via WebAssembly. The token's contents, even sensitive ones, never leave your device.