Read a JWT without mistaking decoding for verification

How to use the workspace

1. Paste a three-part compact token.
2. Optionally set an explicit reference instant with an ISO offset; otherwise the current instant is used.
3. Decode and inspect the header, payload and exp, nbf and iat claims under the persistent UNVERIFIED label.

A concrete starting point

header.payload.signature
exp = expiration time
nbf = not-before time
iat = issued-at time

These names describe conventional claims. Their presence does not establish authenticity or authorization.

Read the result carefully

Timestamp statuses compare recognized claim values with the reference instant. They do not validate the issuer, audience, allowed algorithms or signing key. A future expiration cannot rescue a forged token.

Common mistakes to avoid

• Never grant access based on this decoder output.
• An algorithm named in a token header is untrusted until your verifier applies its own allowlist.
• A real bearer token is a credential. Avoid screenshots, public paste services and synchronized clipboards.

Limits & privacy

Local decoding of three-part tokens, up to the shared 1 MiB input limit. No key retrieval, signature check, issuer lookup or network request. Verification always remains unperformed.