Does decoding a JWT verify it?

No. Decoding is just Base64URL + JSON parsing. Anyone can forge a token with arbitrary claims. Only cryptographic verification with the correct key proves authenticity.

Where is the expiry stored?

In the exp claim of the payload, as Unix seconds. Clients treat a token as expired when the current time is at or past exp, usually with a small clock-skew margin.

Is it safe to paste a token here?

This decoder runs entirely in your browser — the token is not uploaded anywhere. Still, treat tokens as credentials: prefer expired or test tokens for exploration.

TASK

Decode and inspect a JWT safely

Paste a JSON Web Token, read its header and claims, and check expiry — while understanding exactly what decoding does and does not prove.

1

A JWT is three Base64URL segments joined by dots: header, payload, and signature. Decoding only reverses that encoding — it reveals the claims, it does not verify them. Everything below runs locally in your browser; the token never leaves your machine.
2

JWT Decoder →
Paste the full token (including the two dots). The tool shows the decoded header (algorithm, type) and payload (iss, sub, aud, exp, iat, and any custom claims). Malformed tokens are reported with the failing segment.
3

Check three things in the payload: the exp claim (Unix seconds — compare with the current timestamp to see if the token is expired), the iss and aud claims (do they match the service you are calling?), and the alg header (never trust a token whose alg is none, and remember HS256 and RS256 keys are not interchangeable).
4

If you need to know whether the signature itself verifies, that requires the signing key and a verification library on a trusted system — a decoder cannot do it, and this site deliberately does not pretend to.

Frequently asked questions

Does decoding a JWT verify it?: No. Decoding is just Base64URL + JSON parsing. Anyone can forge a token with arbitrary claims. Only cryptographic verification with the correct key proves authenticity.
Where is the expiry stored?: In the exp claim of the payload, as Unix seconds. Clients treat a token as expired when the current time is at or past exp, usually with a small clock-skew margin.
Is it safe to paste a token here?: This decoder runs entirely in your browser — the token is not uploaded anywhere. Still, treat tokens as credentials: prefer expired or test tokens for exploration.