What's inside this token?
Paste a JWT to see its header, what it claims, and when it expires. It is decoded here in your browser — which matters, because a token is usually a working key to somebody's account.
Questions people actually ask
- Is my token sent anywhere?
- No. There is no server involved — the decoding happens in your browser. That is the whole reason to use this page instead of the first result you find, because pasting a live token into someone else's site hands them the session.
- Does it check the signature?
- No, and that is on purpose. Verifying needs the signing secret, and a page that asked you to paste your secret would be worse than the problem it solved. This reads the token; your server decides whether to trust it.
- Is the payload encrypted?
- No. The middle section is only Base64-encoded, which is encoding and not encryption — anyone holding the token can read it, including you, right now. Never put anything secret in a payload.
- Why does it say expired when my app still works?
- Expiry is a claim inside the token, checked against your computer's clock. If they disagree, either your clock is off or the server is not enforcing the claim — and the second one is worth knowing about.