JWT Decoder

No. This tool decodes and displays the token contents. Signature verification requires the secret key or public key, which should never be shared with online tools.

Yes. The token is decoded entirely in your browser using JavaScript's atob() function. Nothing is sent to any server. However, avoid sharing tokens publicly.

The 'exp' (expiration) claim is a Unix timestamp indicating when the token expires. After this time, the token should no longer be accepted by servers.

'sub' is the subject (usually user ID), 'iat' is issued-at timestamp, 'exp' is expiration, 'iss' is the issuer, 'aud' is the audience, and 'nbf' is not-before timestamp.

The header and payload are Base64 encoded, not encrypted. Only the signature needs the key, which is exactly why a JWT should never carry a secret.

It compares the exp claim with your device clock. A token can still be rejected by the server if the two clocks differ by more than the allowed skew.

iat is when the token was issued, nbf is the earliest moment it becomes valid, and jti is a unique id that lets a single token be revoked.

Decoding proves the shape, not the signature. A wrong signing key, a changed algorithm or an audience mismatch all decode perfectly and still fail verification.