Can anyone read the contents of a JWT?

Yes, for ordinary signed tokens. The payload is only encoded. That is why a JWT should never carry a password or other secret in its claims.

Why doesn't this tool verify the signature?

Verification needs the signing secret or public key, and a tool that asked you to paste a secret into a web page would be encouraging a bad habit. Verify tokens in your own server code with a maintained library.

What do exp, iat and nbf mean?

exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds.

Developer Tool

JWT Decoder

Read the header and payload of a JSON Web Token, with its dates shown in plain language.

Runs in your browser — nothing is uploaded

Token

Decoded only — the signature is not verified. A forged token decodes just as neatly as a real one.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "demo-user-42",
  "name": "Asha",
  "role": "learner",
  "iat": 1757980800,
  "exp": 1757984400
}

iat: 2025-09-16T00:00:00Z (your time: 9/16/2025, 12:00:00 AM)
exp: 2025-09-16T01:00:00Z (your time: 9/16/2025, 1:00:00 AM)

What this does

A JSON Web Token is three Base64URL-encoded parts separated by dots: a header describing how it was signed, a payload of claims such as who the user is and when the token expires, and a signature. The header and payload are encoded, not encrypted, so anyone holding the token can read them — this tool simply does that reading for you and turns timestamp claims into readable dates.

Decoding a token proves nothing about whether it is genuine. Only checking the signature with the right key does that, and this tool deliberately does not attempt it. Treat everything it shows as what the token claims, not as something to trust.

How to use it

Paste a token. A demonstration token is filled in so you can see the layout.
Read the decoded header and payload. The exp, iat and nbf claims, if present, are converted to dates and compared with your device's clock.

Where it stops being right

The signature is not verified, so a forged or tampered token decodes exactly as neatly as a real one.
Encrypted tokens (JWE, which have five parts rather than three) cannot be read without the decryption key, and the tool says so rather than guessing.
A live token often grants access to an account. Decoding here happens only in your browser, but as a general habit, avoid pasting production tokens into any website unless you have to.

Questions

Can anyone read the contents of a JWT?: Yes, for ordinary signed tokens. The payload is only encoded. That is why a JWT should never carry a password or other secret in its claims.
Why doesn't this tool verify the signature?: Verification needs the signing secret or public key, and a tool that asked you to paste a secret into a web page would be encouraging a bad habit. Verify tokens in your own server code with a maintained library.
What do exp, iat and nbf mean?: exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds.

More developer tools

All developer tools →