JWT Decoder Verbose

Login handed you a token and the API keeps rejecting it: has it expired? Is the aud wrong? Which user does it represent? A JWT is just base64url — you can open it without any key, and that is what this decoder does. Paste the token and it shows the header, the payload and an annotated list of claims, explaining each registered one (iss, sub, aud, exp, nbf, iat, jti) and converting the timestamps to readable ISO dates as you type.

Two points that pay off in debugging. First: exp, nbf and iat are UNIX seconds, not milliseconds — comparing them directly against Date.now() without dividing by 1000 is a classic bug that makes every token look decades expired. Second: decoding is not validating. The signature (the third part of the token) is not checked here; anyone can forge a payload with admin: true. The server decides whether a token deserves trust, by verifying the signature with the key.

Decoding runs entirely in your browser — the token is never sent to any server. Still, treat a JWT like a password: it grants access for as long as it is valid, so prefer pasting expired or test-environment tokens when investigating. Use the tool to check expiry, audience and custom claims during development; for real signature validation, use your language's JWT library with the issuer's key or JWKS.