A JWT is three Base64URL parts separated by dots: a header, a payload of claims, and a signature. This shows the first two as JSON. Anyone can read them; only the signature proves who issued the token.
How it works
Decoding happens in your browser; the token is not sent anywhere. Still, treat real tokens like passwords: anyone holding one can use it until it expires.
exp, iat and nbf are Unix timestamps in seconds (expiry, issued-at and not-before); they are shown as ISO dates in UTC.
Checking the signature needs the issuer's secret or public key, which a page like this should never ask for.
Examples
eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIiwiZXhwIjowfQ.xHeader:
{
"alg": "none"
}
Payload:
{
"sub": "1",
"exp": 0
}
exp: 1970-01-01T00:00:00.000Z
Signature not verified.These examples are run by the tool itself in our automated tests, so the results shown are what it really returns.
Guides that use this
More tools
Legal entity
Devansh Yadav
Moradabad, Uttar Pradesh
Governing law: Courts at Moradabad, Uttar Pradesh
Phone: +91 8433475698
Legal: legal@analyzeit.in