JWT inspector
Decode a token's header, payload and expiry without sending it anywhere.
Questions
What does this tool do?
The JWT inspector decodes a JSON Web Token: the header and the payload, the expiry and issue times as dates in plain words — expired three days ago, expires in two hours — and the issuer, subject, audience and scope set apart from the rest. It reads the token; it does not verify the signature, so it cannot tell you the token is genuine.
Does it verify the signature?
No. The signature is the third part of the token, and checking it needs the issuer's key, which this page does not have. It shows the header and payload as they are and says whether the times have passed. A decoded token is not a verified token: anyone can write a payload that looks right.
Is it safe to paste a real token?
Nothing leaves this tab — but the token is a key: whoever has it can act as its owner until it expires. Paste it here to read it, and keep it out of chats, tickets and screenshots.
What do exp, nbf and iat mean?
exp is when the token stops being valid, nbf when it starts, iat when it was issued. Each is shown as a date in your time zone and in UTC, with how far from now it is. A token without exp never runs out on its own, and the page says so.
What does alg: none mean?
That the token claims to carry no signature at all, so anyone could have written it. A server should refuse such a token; this page reads it like any other and points out that the signature is missing.
Why does it say the token could not be read?
A JWT is three base64url parts joined by dots, the first two of them JSON. Anything else — two parts, a corrupted part, a different kind of token — shows a short line saying it could not be read.