What's inside a JWT
A JWT has three Base64URL-encoded parts separated by dots: a header (algorithm and key ID), a payload of claims, and a signature. Common claims are iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before) and iat (issued at), all timestamps in seconds since the Unix epoch.
Frequently asked questions
Is it safe to paste a production token here?
Decoding happens in your browser with JavaScript and the token is never sent anywhere. Still, treat live tokens like passwords and prefer expired ones when sharing screenshots.
Does this verify the signature?
No. Verifying needs the issuer's secret or public key. This tool shows what the token claims. Never trust a token's contents unless your server has verified its signature.
Why is my token rejected as expired when it looks valid?
Compare exp and nbf with the current time shown here. Clock drift between servers of even a few minutes can cause intermittent rejections. Most libraries allow a small leeway setting.
What is the difference between JWS and JWE?
A JWS (three parts) is signed, and anyone can read its payload. A JWE (five parts) is encrypted and can't be decoded without the key.