Does this verify the signature?

No. Verification needs the secret or public key, so it must happen on your server. This tool only decodes.

Is my token sent anywhere?

No. Decoding happens in your browser and the token is not stored or logged. Even so, avoid pasting live production tokens.

What do exp, iat and nbf mean?

They are Unix timestamps for expiry, issued-at and not-before. The decoder shows them as readable dates.

JWT Decoder

Decode JWT header and payload claims locally in your browser.

JWT

Token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decoded locally in your browser. Do not paste sensitive production tokens.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Signature

SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

This is the raw signature segment. It is not verified — no signing key was provided, and this tool never claims to validate a signature it can't check.

About the JWT Decoder

A JWT is three Base64URL segments separated by dots: header, payload and signature. The first two are only encoded, not encrypted, so anyone holding the token can read the claims.

This decoder never verifies the signature — doing so requires the signing key, which should never leave your server. Treat the decoded output as informational and never paste production tokens into any online tool, including this one.