Auth search tool
JWT exp checker
JWT time claims are Unix timestamps. Decode the token to see whether exp, iat, and nbf map to the dates you expected.
Examples for this search
Check whether exp is in the past.
Compare issued-at time with logs.
Convert nbf into readable time.
Toolvert base64url-decodes the header and payload in the browser. It does not verify the signature, so the result is useful for inspection, not trust decisions.
What this jwt decoder does
Use this JWT decoder when you need to inspect token claims while debugging authentication. It decodes the header and payload locally and clearly states that the signature has not been verified.
Common use cases
- Check a token expiration time while debugging auth.
- Inspect issuer, audience, subject, scope, and custom claims.
- Strip a Bearer prefix from a copied Authorization header.
- Compare token metadata with server logs or API responses.
Accepted input formats
header.payload.signature
Bearer header.payload.signature
exp, iat, nbf
How it works
Toolvert base64url-decodes the header and payload in the browser. It does not verify the signature, so the result is useful for inspection, not trust decisions.
Common mistakes
- Decoded does not mean valid. Signature verification requires the right key or secret.
- Avoid pasting production tokens into shared screenshots or bug reports.
- An expired token may still decode successfully; check the exp claim.
Frequently asked questions
Does this verify JWT signatures?
No. It decodes token contents only and labels the signature as not verified.
Can it read Bearer tokens?
Yes. It strips a leading Bearer prefix before decoding.
Does Toolvert store tokens?
No. Tokens are decoded locally and are not saved by default.