A leading “Bearer ” is accepted.
Paste a token and its header, payload and expiry verdict appear here.
Paste a JWT to see its header and payload formatted, with issue and expiry times converted to readable dates. The signature is not verified, and the page says so.
Questions
Is the token sent anywhere?
No. It is base64-decoded and formatted entirely in the browser.
Can I paste a production token?
This tool will not send it, but it is still unwise. A JWT is a credential, and it lingers in screen shares, recordings and browser history. Use an expired or test token.
Can it check the signature?
No. That needs the issuer’s key, and there is no mechanism here to hold one. Verification belongs on the server receiving the token.
It decodes fine but authentication fails.
Readable and valid are different things. Suspect expiry, a mismatched audience or issuer, or a signature that does not check out.
Is the content encrypted?
No. A signature shows the token was not altered in transit; it does not hide anything. Header and payload are readable by anyone who base64url-decodes them. If a value has to stay secret, either use the encrypted variant of the spec (JWE) or keep it out of the token and look it up server-side.
I logged out and the token still works.
A JWT is valid from issue until expiry by design; there is no built-in way to revoke one. Invalidating on logout requires the receiver to keep a revocation list, or a short expiry paired with refresh tokens. This is a property of the specification rather than a bug in an implementation.
Can this tell me whether the token has expired?
It shows exp as a readable date, so comparing it with now answers the question. The actual decision belongs to the receiving server, though, and its clock may differ from your device’s. Do not settle a borderline case from this screen alone.