Can I trust the claims in a JWT I decoded?

No. The header and payload are Base64-encoded, not encrypted. Anyone can create a token with any claims. Only signature verification (using the secret for HS256, or the public key for RS256) proves the claims were issued by a trusted party.

What does 'exp' claim mean?

exp is the expiry time as a Unix timestamp. After exp, the token should be rejected. The tool converts it to a readable date so you can see at a glance whether the token is still time-valid.

Inspeccionar un JWT token: decodificar encabezado y payload sin verifying

Leer el estructura de un JSON Web Token a see its algoritmo, claims, y expiry — purely cliente-side, no servidor validation.

1

A JWT is three Base64URL-encoded JSON segments (header.payload.signature) joined by dots. The header and payload are not encrypted — anyone can decode them. Only the signature (which requires the secret/public key) proves authenticity.
2

Decodificador de JWT →
Paste the JWT. The tool decodes the header and payload, renders the claims as formatted JSON, and highlights the exp/nbf/iat time claims with human-readable dates.
3

base64-decode → json-format
Ver receta Abrir en cadena de herramientas

Use the parse chain to decode the JWT and additionally check whether exp/nbf claims are in the past/future, giving a quick 'is it currently valid?' signal.
4

Remember: decoding a JWT is NOT verification. The payload can be forged by anyone. Never trust JWT claims for authorization without verifying the signature server-side with the secret or public key.

Preguntas frecuentes

Can I trust the claims in a JWT I decoded?: No. The header and payload are Base64-encoded, not encrypted. Anyone can create a token with any claims. Only signature verification (using the secret for HS256, or the public key for RS256) proves the claims were issued by a trusted party.
What does 'exp' claim mean?: exp is the expiry time as a Unix timestamp. After exp, the token should be rejected. The tool converts it to a readable date so you can see at a glance whether the token is still time-valid.

Flujos que resuelven esta tarea

Codificar en Base64 y decodificar para verificar ida y vuelta

Codificar texto a Base64 y decodificarlo para verificar que el recorrido de ida y vuelta preserva los datos originales.

Preguntas frecuentes

Flujos que resuelven esta tarea

Herramientas relacionadas