Frequently asked questions
- Is my data uploaded to a server?
- No. Every operation runs inside your browser using JavaScript. Nothing you paste or type is sent to our servers, stored or logged. You can disconnect from the network after the page loads and the tool keeps working.
- Does this verify the signature?
- No, and it deliberately cannot. Verifying needs the issuer's secret or public key, and asking you to paste a signing secret into a web page would be a bad idea however that page was built. Decoding tells you what a token claims; only the issuer's key tells you whether to believe it.
- Is it safe to paste a real token here?
- Safer than anywhere that uploads it, because this runs entirely in your browser and the token never leaves your device. That said, a JWT is a credential: treat one from production the way you would treat a password, and prefer an expired or test token when you can.
- What do exp, iat and nbf mean?
- Expiry, issued-at and not-valid-before. All three are seconds since 1 January 1970, not milliseconds, which is why a token read by a tool that assumes milliseconds appears to expire in 1970. This shows each as a readable date and says whether the token has expired.
Related tools
Stuck on an error?
Every common JSON parse error is explained separately, with the cause and the fix: common JSON errors.
How your data is handled
Everything happens on your device. There is no upload, no storage and no logging, and only your interface preferences - theme, indentation, font size and word wrap - are kept between visits. Closing the tab clears the document.