JWT Decoder Online — Read Header and Payload

No. It decodes the first two segments and prints them as JSON. Verifying a signature needs the HMAC secret or the RSA public key, and pasting either into a web page is a bad habit. Read this as a window into the contents: a payload that decodes cleanly says nothing about whether the token is valid.

Look at exp, a Unix timestamp in seconds marking the point after which a server must reject the token. Compare it against the current time; if exp is smaller, that expiry is what your 401 is about. The iat claim records when the token was issued, and nbf the earliest moment it may be used.

Usually something extra rode along: the word Bearer, quotation marks from a JSON response, a line break in the middle, or a tail truncated by a narrow log column. A real JWT is exactly three parts separated by two dots and contains no spaces. Copy the full string again and retry.

This page decodes in your own tab and sends the token nowhere. Even so, a live access token is working access to an account: if it has not expired, revoke the session first or use one from a staging environment. Tokens should never go into services that decode them server-side.

It means the token carries no signature at all. Historically this is a well-known attack: a backend that accepts none lets anyone forge a payload. Seeing none against production traffic is a reason to fix validation on the server, not a quirk of the decoder.

You can change the text, but you cannot rebuild a working JWT. The signature is computed from a secret the browser does not have, so any server will reject the edited token. This tool is read-only; issue tokens with a library on your own side.