JWT Decoder

No — and nothing on this page claims to. Decoding is not verification: this tool does not check the signature, so a decoded token proves nothing about authenticity. The signature segment is reported as present or absent and left alone. Verification needs the issuer's key and a proper library in your own systems.

The decoding runs entirely in your browser — the token is never uploaded or stored. That said, a live bearer token is a credential: anyone holding it can use it until it expires, so treat it with the same care as a password, decode copies rather than production tokens where you can, and never post one in a bug report or chat.

You can edit the JSON and base64url-encode it with the Base64 tool, but the result will not be accepted anywhere the signature is checked — changing one byte of the payload invalidates the signature, which is the entire point of signing. An edited token is useful only for testing how a decoder or a test harness reads claims.

Two common reasons: the judgement here uses your device's clock, and a wrong system clock skews it; and many systems allow a small leeway (often 30–60 seconds) around exp and nbf for exactly that skew. A token hours past exp that still works is a server that is not checking expiry — a real finding, not a tool error.

The payload carries neither exp nor nbf, so by its own text the token has no time window to judge — like the demo token in the worked example, which has only iat. It does not mean the token is valid forever in practice; issuers and servers can enforce lifetimes the token itself does not state.

The signature: the header and payload, signed with the algorithm named in the header (HS256 in the demo token) using a secret or private key held by the issuer. This tool shows it as present/absent only — reading it tells you nothing without the key, and checking it is deliberately out of scope here.