The fastest way to answer "why am I getting a 401"
A JWT is three dot-separated pieces — header, payload, signature — and the first two are nothing more than Base64URL-encoded JSON. It is encoding, not encryption, so anyone can read it.
Paste a token and you get the expiry in UTC along with how long is left, or how long ago it lapsed. When authentication suddenly stops working, this is the first thing to check.
The standard claims
| Name | Meaning |
|---|---|
exp | Expiry. Past this moment the server rejects the token |
iat | Issued at |
nbf | Not valid before this time |
iss | Issuer — which authentication server minted it |
sub | Subject, usually the user ID |
aud | Audience — the service meant to accept it |
Every time claim is a Unix timestamp in seconds. Passing milliseconds is a common slip, and the server then reads the token as expiring fifty thousand years from now.
The signature is not verified
This tool only reads the token. It does not check that the signature is valid. Doing so needs the secret key (HS256) or the public key (RS256), and building a web page that invites you to paste a secret key is a bad design in itself, so it is not here.
Which means: decoding successfully does not mean the token is valid. Anyone can edit a payload and re-encode it, and only verifying the signature reveals the forgery.
If alg is none
That says "accept this without a signature". Older JWT libraries took it at face value, and several complete authentication bypasses came of it. A warning is attached in the summary — see this on a production token and go look immediately.
Is the token sent to a server?
No. An access token is a credential in its own right, so pasting one into an online JWT tool is no different from pasting a password. This page uses no network after it loads. Even so, for a live production token, get into the habit of revoking it once you are done.
Can I put a password in the payload?
No. The payload is readable by anyone. A signature does not hide the contents; it guarantees they have not changed.
I only have part of a token — can I decode it?
If you have the middle piece, put it into Base64 Decode and the payload JSON comes out. base64url and missing padding are handled automatically.