Signature verification is not supported. The payload is just Base64-decoded — verify it on your server.
Decoding is not verifying
A JWT is three Base64url pieces joined by dots, and anyone can read the first two without a key. This tool shows you what is inside. It does not — and cannot — tell you whether the signature is genuine; only a server holding the key can do that.
What the standard claims mean
exp is when the token stops being valid, iat when it was issued, nbf the earliest it may be used, iss who issued it, sub who it is about, aud who it is for. All the time fields are Unix seconds, not milliseconds.
While you’re here — claim a crypto exchange bonus
More calculators
Frequently asked questions
Q. Is my token sent anywhere?
No. The split and Base64 decode happen in your browser. Still, treat any token you paste anywhere as compromised and rotate it if it was a live one.
Q. Why does the payload look readable?
Because a JWT is signed, not encrypted. Base64url is an encoding, not a secret. Never put anything private in a payload.
Q. Can you check the signature here?
No. That needs the signing key, and a key pasted into a web page stops being a key. Verify server-side.