Status
Valid
Token
The signature is shown, not verified. Verifying needs your secret or public key, and this page never asks for one.
No token yet The status, expiry and findings appear here.
Paste a JWT. See if it's still valid, and what's wrong with it.
The signature is shown, not verified. Verifying needs your secret or public key, and this page never asks for one.
No token yet The status, expiry and findings appear here.
Status
A JSON Web Token is a signed string a server gives you after login. It has three parts separated by dots: a header, a payload with claims like who you are and when it expires, and a signature.
The token is decoded inside this browser tab and never sent anywhere: open your browser's Network panel and you will see no requests. Still, treat live production tokens like passwords on any site.
Verifying needs your secret or public key, and a web page should never ask for one. The header and payload are only Base64url-encoded, so they can be read without the key; the signature is what stops anyone from changing them.
It compares your device clock with the exp claim, and with nbf for tokens that are not valid yet, following RFC 7519: a token is expired from the exact second of exp.
alg: none means the token is unsigned and must never be accepted. A missing exp means it never expires. jku, x5u or a path-like kid in the header can point a careless server to an attacker's key.
No. The token is decoded inside this browser tab, and it isn't sent or saved anywhere.