What a token contains
A JWT is three Base64url-encoded parts separated by dots: a header saying how it was signed, a payload of claims, and a signature over the first two.
The important consequence: the payload is readable by anyone who has the token. It is signed, which proves it was not altered, not encrypted, which would keep it secret. Internal user identifiers, roles and e-mail addresses in a JWT are visible to whoever holds it.
The claims that matter
| Claim | Meaning |
|---|---|
exp | expiry; after this the token should be rejected |
iat | when it was issued |
nbf | not valid before this time |
iss | who issued it |
sub | who or what it is about |
aud | which service it is meant for |
The tool converts every timestamp to your local time and states plainly how long the token is still valid, which is usually the actual question when debugging a failing request.
Why this page will never ask for your secret
Plenty of online JWT tools offer signature verification and provide a field for the signing secret. Pasting a production signing secret into a web page hands over the ability to mint tokens for your system. That is not a debugging step, it is a key disclosure.
Signature verification belongs in your own code or a local command-line tool, where the key already is. This page shows you the signature and stops there.
A safe debugging habit
Treat a token like a password. Do not paste production tokens into chat, tickets or random websites, and prefer a short-lived test token when you need to inspect the shape of a payload. When a token has leaked, the fix is to rotate the signing key, not to hope nobody looked.
Questions
Is my token sent to a server?
No. The decoding is three Base64url decodes and a JSON parse, all in your browser. You can verify it in the network tab of developer tools: no request is made.
Why do you not verify the signature?
Verifying needs the secret or the public key. A tool that asks you to paste your signing secret is asking for the key to your whole system. Verify in your own code, where the key already lives.
Is the payload encrypted?
No. A standard JWT is signed, not encrypted. Anyone holding the token can read every claim in it. Never put anything confidential in a JWT payload.
What does alg: none mean?
It means the token is unsigned. Any system that accepts such a token accepts a token anyone can forge. If you see it outside a test, treat it as a finding.
The times look wrong.
JWT timestamps are seconds since 1970 in UTC. They are shown here in your local time zone, which is usually the discrepancy people notice.