Paste a compact JSON Web Token to inspect its first two Base64URL-encoded parts. Decoding does not verify that the token is authentic or trustworthy.
Decode JWT header and payload JSON locally, inspect exp, iat and nbf timestamps, and keep signature verification clearly separate.
A compact JWT typically contains a Base64URL-encoded header, a Base64URL-encoded payload and a signature. The first two parts can be decoded without any secret key.
That means decoding only reveals the claims carried in the token. It does not prove that the issuer created the token or that the payload has not been altered.
Real verification requires the expected signing algorithm and the correct verification key or public key, plus validation of issuer, audience and any application-specific policy.
Toolmera intentionally does not present decoded claims as verified. The exp, iat and nbf timestamps are shown as convenience fields only.
Enter the three-part token you want to inspect.
Toolmera Base64URL-decodes the first two parts and formats their JSON locally.
Review exp, iat and nbf timestamps while remembering that this tool does not verify the token signature.
Useful next steps in the same workflow.
No. This page decodes the header and payload only.
exp is a NumericDate claim representing the token expiration time in seconds since the Unix epoch.
iat is the issued-at NumericDate claim when the issuer includes it.
No. JWT payloads are commonly Base64URL-encoded rather than encrypted, so sensitive information should not be assumed private simply because it appears inside a token.