Can anyone read a JWT?

Yes. The header and payload are only Base64-encoded, so anyone with the token can read them. That is why you must never store secrets in the payload.

Is it safe to decode my token here?

Yes. Decoding happens in your browser and the token is never uploaded.

Why can't I verify the signature without a key?

Verification needs the secret or public key held by the server. Decoding only reads the token; it does not prove it is genuine.

How do I know if a token is expired?

Look at the exp claim, a Unix timestamp. If it is in the past, the token has expired.

How to Decode a JWT (and What Each Part Means)

A JWT (JSON Web Token) is that long string with two dots in it that APIs hand out after you log in. It looks encrypted, but the first two parts are just Base64url-encoded JSON — meaning anyone can read them. Understanding that is the single most important thing about JWTs.

The three parts

Header — which signing algorithm was used.
Payload — the claims: who the user is, when the token expires (exp), and any roles or scopes.
Signature — a cryptographic seal that lets the server confirm the token has not been tampered with.

How to decode one

Open the JWT decoder and paste the token.
Read the decoded header and payload as formatted JSON.
Check the exp claim to see whether the token has expired.

Decoding is not verifying

Because the payload is only encoded, never trust its contents on the client side — a user can read and even rewrite it. Only the server, which holds the secret key, can verify the signature and trust the claims. And never paste a live production token into a site that sends it to a server; a browser-only decoder keeps it on your machine.

If a token is failing, decode it first and look at exp. A surprising share of 'auth is broken' bugs are simply an expired token or a clock that is out of sync.

Tools that just work