Paste a token to see its header and payload decoded, with the time claims rendered as dates and the expiry checked against now. Decoding happens in your browser and nothing is sent anywhere — which matters, because a JWT is a credential and pasting one into a remote service hands over whatever it authorises.
The header and payload are Base64url — an encoding, not encryption. Anyone holding the token can read every claim in it, which this page demonstrates by doing exactly that with no key. The signature proves the token has not been altered; it hides nothing. Putting anything confidential in a payload is putting it in public.
Verification needs the signing secret or the public key. Pasting a signing secret into a web page is precisely the habit that leaks credentials, so this tool declines to ask. It tells you what the token claims and is explicit that it has not checked whether any of it is true.
A token can declare itself unsigned. Libraries that honour that declaration will accept a token whose signature has been deleted — meaning anyone can forge any claim, including administrator rights. It has caused real breaches, and it is still found in production. The decoder flags it.
exp and nbf are Unix timestamps in seconds, not milliseconds — a JWT library fed milliseconds will happily issue tokens valid until the year 55000. Verifiers usually allow a small clock-skew tolerance, typically 30 to 60 seconds, so a token can be accepted a moment after nominal expiry.
No, and this surprises people. The header and payload are Base64url-encoded, not encrypted — anyone holding the token can read every claim in it. The signature proves the token has not been altered; it does not hide anything. Never put a secret in a JWT payload.
Verifying needs the signing secret or public key, and pasting either into a web page is exactly the habit that leads to leaked credentials. This tool tells you what a token claims and is explicit that it has not checked whether those claims are genuine.
A token can declare that it is unsigned. Libraries that honour that declaration will accept a token whose signature has simply been deleted, letting anyone forge any claim. It has caused real breaches. The decoder flags it when it appears.
Steuervergleich Kanton Zürich — Gemeindesteuern vergleichen (Deutsch)