What a JWT is
A JSON Web Token is a compact way for one system to hand another a small set of facts, often used to show that a user has logged in. It is three pieces joined by dots: a header that says how the token is signed, a payload of claims such as who the user is and when the token expires, and a signature. The header and payload are just JSON written in Base64URL, which is a way of encoding text, not of hiding it. Anyone who holds a token can read it, which is what this page does. Paste a token and you will see both parts laid out, with the standard time claims turned into dates: exp (when it expires), iat (when it was issued) and nbf (not valid before).
What this tool does not do
It decodes but doesn’t verify. Checking the signature needs the secret or public key, which only the service that issued the token should have, and a decoded token says nothing about whether it is genuine. Don’t trust the contents of a token you haven’t verified on a server. The status line (“Expired” or “Not expired”) only compares the exp claim with your device’s clock.
Questions
Is it safe to paste a real token? The page works entirely in your browser and sends nothing, but a live token can be used by anyone who sees it, so for tokens from a real service, prefer test tokens, or ones that have already expired. Why does it say my token is not valid? Check that you copied all three parts and no extra characters; a leading “Bearer ” is removed for you. Encrypted tokens (JWE) have five parts and can’t be read. For converting the timestamps by hand, use the Timestamp Converter.