JWT Expiration & Payload Decoder

Inspect JSON Web Token expiration countdown, issued-at time, claims payload, and algorithm header with 100% private in-browser decoding.

Encoded JSON Web Token (RFC 7519)

Paste JWT Token String 100% Client-side. Decoded locally in your browser; tokens are never transmitted to any server.

Test Presets

Token Expiration Status

Expires At (exp)

Issued At (iat)

Decoded Payload Claims

--

Header & Algorithm

--

Signature Structure

How JSON Web Token (JWT) Expiration & Decoding Works

JSON Web Tokens (IETF RFC 7519) are compact, URL-safe security credentials consisting of three Base64URL-encoded parts concatenated with period (.) delimiters: Header, Payload, and Signature.

Standard Expiration Claims

exp (Expiration Time): A Unix timestamp in seconds identifying when the token expires. If CurrentTime > exp, the token is expired and must be rejected by backend authentication filters.
iat (Issued At): Unix timestamp indicating when the token was signed and minted by the authorization server.
nbf (Not Before): Unix timestamp defining the earliest moment at which the token becomes active and acceptable for processing.

Privacy & Security

Standard online JWT decoders often transmit authentication credentials across external HTTP networks. This calculator runs 100% locally in your browser using client-side JavaScript base64 decoding. No bearer token, cookie, or API key ever leaves your machine.

Frequently Asked Questions

Does this tool verify the cryptographic signature?

This tool verifies the compact 3-part syntax, decodes the algorithm header, and extracts the signature bytes. Cryptographic validation of asymmetric RS256/ES256 signatures requires supplying the authorization server's public key (JWKS), whereas HMAC HS256 requires a private shared secret. For security, never paste shared secret keys into third-party websites.

Is it safe to paste production JWT tokens into this tool?

Yes. This tool performs all decoding entirely client-side using JavaScript string parsing and Base64URL decoding in your browser sandbox. No network requests or telemetry transmissions contain your token.

What is the format of the exp claim?

Per RFC 7519, the exp claim is a numeric value representing the number of seconds (not milliseconds) since the Unix Epoch: January 1, 1970 00:00:00 UTC.