Question 1

Does this tool verify the JWT signature?

Accepted Answer

No, and it never will — this is a decoder, not a verifier. It reads the header and payload (both are just base64url-encoded JSON, no secret required) and shows you the signature segment as-is, but it makes no attempt to check that signature against any key or algorithm. Verifying a signature requires the secret or public key the token was signed with, which is not something a client-side tool should ever ask you to paste in.

Question 2

Is it safe to paste a real, production JWT into this tool?

Accepted Answer

The token itself never leaves your browser — there are no network calls, so nothing is sent anywhere. That said, decoding a live credential still means displaying it in plain text on your screen, so the usual precautions apply regardless of which tool you use: don't do this on a shared or untrusted machine, and be mindful of screen-sharing during a debugging session.

Question 3

Why does the expiry time show in my local timezone instead of UTC?

Accepted Answer

The exp, iat, and nbf claims are stored in the token as UTC Unix timestamps (seconds since the epoch), but this tool formats them using your browser's local timezone for readability, since that's usually what you actually want when checking "has this expired yet." If you need the raw UTC value, the underlying number is unchanged — only the display is localized.

Question 4

What happens if my JWT doesn't have an exp, iat, or nbf claim?

Accepted Answer

Those claims are all optional per the JWT spec, so the tool simply omits whatever is missing — no error, no placeholder. A token with no exp claim, for example, is treated as non-expiring rather than flagged as invalid.

Question 5

Can I paste a token copied straight from an Authorization: Bearer header?

Accepted Answer

Yes — a leading "Bearer " prefix is detected and stripped automatically before decoding, since copying the full header value (rather than trimming it manually first) is the most common way people actually get a JWT to paste.

JWT Decoder

Decode, Not Verify

Human-Readable Timestamps

Local Processing

Frequently Asked Questions