JWT Decoder

No. Verifying a signature requires the secret or public key known only to the issuer, so this tool only displays the signature part without validating it.

If the value isn't in header.payload.signature form (three parts separated by two dots), a message tells you it's not a valid format.

exp is the standard claim for expiration time, and iat is issued-at time. They're stored as Unix timestamps in seconds, which this tool converts into a human-readable date.

No. All decoding happens entirely in your browser and is never sent to or stored on a server.

Processing itself only happens in your browser, but real tokens can contain personal or authorization data, so please clear the pasted value afterward on a shared computer.