ToolwebHow to use this tool
- Prefer the example or a nonsensitive token.
- Read the header and payload of a three-part JWT.
- Treat time displays as references; verify signatures, issuer and audience on your server.
Read an unverified claim
- Input and settings
- payload: {"sub":"demo","iat":1700000000}
- Result
- iat UTC: 2023-11-14T22:13:20.000Z
A readable timestamp says nothing about signature validity.
Processing rules and reading the result
The first two Base64url segments are decoded as UTF-8 JSON, preserving original number tokens for display. Numeric iat/nbf/exp fields are converted from second-based NumericDate for reference only.
Limits and checks before use
Up to 20,000 characters; only three-part tokens with JSON-object headers/payloads are supported. No JWE, signature verification, decryption or token issuance. Protect live tokens from clipboard/screen-sharing exposure too.
Common questions
Is a token usable when exp is in the future?
No. Claims can be modified by an attacker; signature, algorithm, issuer, audience and application policy require independent checks.