Paste a JSON Web Token and instantly see its decoded header and payload: algorithm, expiry (exp), issue time (iat), subject and custom claims. The token is decoded locally and never sent anywhere.
The token is decoded locally in your browser and is not uploaded. Still, treat production tokens like passwords and prefer expired ones for debugging.
No — it decodes and displays the contents. Signature verification requires the secret or public key and should happen on your server.
Most often the exp claim is in the past, the clock skew is too big, or the audience/issuer claims don't match what the API expects.
A regular signed JWT (JWS) is only Base64-encoded, not encrypted — anyone can read it. Don't put secrets in the payload.