96 chars · 1 line
122 chars · 10 lines
Algorithm: HS256Signature not verifiedTime status: Not evaluated (no numeric exp/nbf)
96 chars · 1 line
122 chars · 10 lines
JSON Web Token guide
Paste a three-part JSON Web Token to inspect its Base64URL-encoded header and payload. VetaTool formats the JSON, shows the algorithm, converts iat, nbf, and exp claims to ISO dates, and reports whether the numeric time window is active, expired, or not active yet without sending the token over the network. This tool is free to use. No account or payment is required.
Last updated
A compact JWT normally has three dot-separated segments: a header, a payload, and a signature. The first two segments contain Base64URL-encoded JSON objects.
Common registered claims include sub for the subject, iat for the issued-at time, nbf for the not-before time, and exp for the expiration time.
This tool decodes readable token data, but the signature is not verified. A decoded payload can be modified by anyone unless a trusted service validates the signature, algorithm, issuer, audience, and other required claims.
The decoder requires exactly three non-empty segments, canonical Base64URL data, and JSON objects for both the header and payload. NumericDate claims such as iat, nbf, and exp are displayed as ISO timestamps when they are valid finite numbers. The time status uses only numeric exp and nbf claims: it can report active, expired, not active yet, or not evaluated when the time gates are missing or malformed.
The token header identifies the algorithm and the payload exposes claims such as subject and expiry time.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwiaWF0IjoxNzAwMDAwMDAwfQ.c2lnbmF0dXJl{
"header": {
"alg": "HS256",
"typ": "JWT"
},
"payload": {
"sub": "1234",
"iat": 1700000000
}
}
Signature not verifiedCommon questions
No. It only decodes the header and payload. Signature verification requires the correct secret or public key and trusted validation rules.
Yes. JWT payloads are encoded, not encrypted, so anyone holding the token can usually read the claims.
Valid numeric values are treated as Unix seconds and shown as ISO dates. Numeric exp and nbf claims are also compared with the current time to report active, expired, or not active yet; this is a time-window check, not signature verification.
No. Header and payload decoding run locally in your browser.
Looking for broader references? Browse all developer guides.
Debugging a specific JWT issue? Browse JWT troubleshooting.