How to use it
Paste a token from an Authorization: Bearer header, a cookie or your app's storage. The header and payload are decoded instantly, and the time claims are shown as readable dates with a clear expired or not-expired status.
What the parts mean
- Header: the signing algorithm (
alg, such as HS256 or RS256) and token type. - Payload: the claims — who the token is for (
sub), when it was issued (iat), when it expires (exp), plus anything your app adds. - Signature: proves the token was not changed. Checking it needs the secret or public key, which only your server should have.
Questions
Is it safe to paste a real token here?
Decoding happens in your browser and nothing is sent anywhere. Still, treat live tokens like passwords: prefer test tokens, and never share production tokens in chats or tickets.
Does this verify the signature?
No. Anyone can decode a JWT because the payload is only Base64URL-encoded, not encrypted. Verification needs the key and must happen on your server.
Why is my token "expired" when it was just created?
Usually the server clock is wrong, or exp was set in milliseconds instead of seconds. exp must be seconds since 1 January 1970 UTC.
What does "No exp claim" mean?
The token has no expiry time, so it stays valid until the signing key changes. Most APIs should issue short-lived tokens with exp set.
More tools
- PDF editor — fill, sign, annotate and redact
- Compress image to a target size
- Image converter and resizer
- Images to PDF
- Merge PDF files
- Split PDF and extract pages
- Rotate PDF pages
- QR code generator — links, UPI, Wi-Fi, contacts
- URL shortener with click count
- Unit converter
- JSON formatter and validator
- Unix timestamp converter
- Base64 encoder and decoder
- Encrypt and decrypt text or files with a password
- Hash generator (MD5, SHA-256, HMAC)
- Strong password generator
- Cron expression explainer
- Regex tester
- JSON to CSV converter (and CSV to JSON)