Take a quiet look inside a JWT.
Paste a JSON Web Token to read its header, payload and expiry. Decoding happens right here in the page.
Signature is not verified.TokenPeek only decodes. A readable token is not a trusted token.
Header
Payload
Time claims
Signature (as is, not checked)
How it works
1. Split
A token is three base64url parts joined by dots: header, payload and signature.
2. Decode
The first two parts are decoded as UTF-8 text and pretty-printed as JSON.
3. Compare
The exp, iat and nbf claims are Unix seconds. They are shown in UTC and against your clock.
FAQ
Is my token uploaded?
No. The page is static and the code that decodes the token runs only in your browser.
Does a valid-by-time token mean it is genuine?
No. Only the party holding the key can check the signature. TokenPeek never does.
Which algorithms are supported?
Any. The header is only displayed, never acted upon.