Paste a token and see its header, its payload and its timestamps as readable dates. Two things matter about how this is done. The token is decoded in this page, so an access token — which is a live credential — is not pasted into someone else’s server. And the result says, every time, that the signature has not been verified: decoding a token proves nothing about whether it is genuine, and treating the two as the same thing is how forged tokens get trusted.
This page loads no libraries at all — the work is done by the browser itself. Your file is read on your own machine and never sent anywhere — open your browser's network tab and watch while you use it.
No, and no browser tool can. Verification needs the secret or the public key that signed the token, which lives on the server. What you see here is the payload the token claims, which anyone can write: the middle section is ordinary Base64, not encryption. That is why the result carries the warning every time. Decode to debug; never decode to decide whether someone is allowed in.
Safer than the alternative, because nothing is sent anywhere — the decoding happens in this page on your machine, and you can watch the network tab to confirm it. That said, an unexpired access token is a live credential, so the usual care applies: do not paste one into a screenshot, a chat, or a page you have not checked.
A JWT has three sections separated by dots, and each is Base64URL rather than plain Base64 — plus and slash are replaced by minus and underscore, and the padding is dropped. A decoder that ignores that difference either throws an error or, worse, returns mangled text. If a token still fails here, the message says which part did not decode.
They are seconds since 1970, shown as UTC dates: iat is when it was issued, exp when it stops being accepted, and nbf the earliest moment it may be used. The summary also tells you whether exp has already passed, which is the usual reason a request is being rejected.
Everything here is free and works the same way — in your browser.