JWT Decoder

Decoding alone does not verify authenticity, since the header and payload are only base64url-encoded, not encrypted, and anyone can read them without a key. To check whether a token was really signed by the expected party, use the optional signature verification field below, which only supports the HS256 algorithm.

HS256 uses a single shared secret for both signing and verifying, so this tool can check a signature using only the secret you provide. RS256, ES256, and other asymmetric algorithms sign with a private key and verify with a different public key, which this tool does not collect, so verifying them safely is out of scope here.

These are standard JWT timestamp claims, all expressed as Unix time (seconds since 1970). exp is when the token expires, iat is when it was issued, and nbf ("not before") is the earliest time the token is considered valid. This tool converts each one into a readable date automatically.

It means the exp claim in the payload is a timestamp earlier than the current time, so a server correctly validating this token would reject it. This tool only checks the claim and your device clock, it does not contact any server.

The token is decoded entirely in your browser and never sent anywhere, so pasting it here is as safe as viewing it in your own browser's developer console. That said, treat any token with sensitive claims the same way you would treat a password, and avoid pasting tokens into tools you don't trust.