How it works
How a token is read
A JWT is three base64url parts joined by dots: header, payload and signature. The first two are decoded from base64url to UTF-8 and parsed as JSON, then shown indented. A leading Bearer is ignored.
Decoding is not verifying. Anyone can read the payload; only the signature proves the token was not changed.
Dates and validity
The iat, nbf and exp claims are seconds since 1970. They are shown as UTC times, and the status compares them with your computer’s clock: expired once the time reaches exp, not valid yet before nbf.
A token with no exp claim is reported as having no expiry.
Checking the signature
For HS256, HS384 and HS512 the tool signs the first two parts with the secret you type using the browser’s Web Crypto, and compares the result with the token’s third part.
Tokens signed with RSA or ECDSA (RS256, ES256 and so on) need a public key and are decoded only, not verified.
