Fineuralab

Decode JWT Claims and Expiration

A JWT decoding example that explains exp, iat, audience, and why decoding is not verification.

Worked example

Task context

A demo token appears to expire too early. Decode the header and payload, read exp and iat, and remember that a browser decoder cannot prove the signature is valid.

Open the related tool: JWT Decoder

Input and output

Input token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vLXVzZXIiLCJhdWQiOiJ0b29sa2l0cy1kb2NzIiwiaWF0IjoxNzgxNDk0NDAwLCJleHAiOjE3ODE0OTgwMDB9.demo-signature

Decoded payload

{
  "alg": "HS256",
  "typ": "JWT",
  "sub": "demo-user",
  "aud": "toolkits-docs",
  "iat": 1781494400,
  "exp": 1781498000
}

Checks before copying

Convert exp and iat into local time before making a claim about expiry.
Check aud and iss against the service that issued the token.
Do not paste live production tokens into public screenshots or tickets.

Lesson: JWT decoding is only inspection. Signature verification requires the issuer's key material and a trusted verification path.

Keep working

JWT DecoderDecode JWT header and payload locally without verifying the signature. JSON and API Debugging WorkflowA focused workflow for formatting JSON, validating schema, decoding tokens, and checking API examples. JWT Decoder in a Local BrowserDecode JWT header and payload locally while remembering that decoding is not signature verification. Examples LibraryBrowse worked examples for core browser tools. Workflow HubsBrowse task-based tool workflows.

Reviewed and updated: June 23, 2026