# JWT decoder: run it free, or from your agent Decodes a JWT header and payload and shows exp, iat and nbf as dates. Local only, no signature check. ## Prompt Use looot to check an API token before a run. 1. Set up https://looot.ai/skill.md. 2. Decode this JWT on this machine only, never send it to any endpoint: [paste a token you are allowed to share]. 3. List alg, iss, aud, sub, scopes and exp as a UTC date. 4. Say whether it has expired and what the expiry means for a long batch of calls. ## What it needs A JSON Web Token ## What comes back - header JSON - payload JSON - issued, not before and expiry times - expired or not - warnings such as alg none ## Endpoints and providers None. The tool on the web page runs in the browser and calls no endpoint. ## What it costs Nothing. The tool on the web page runs in the visitor's browser: no account, no API call and no limit per hour. The prompt above runs the same job from your own looot account with current data, billed per call. ## Debug a 401 See at once if the token expired, has the wrong audience or lacks a scope. ## Read claims Check the user id, roles and tenant your auth provider put in the token. ## Check the alg Spot alg none or an algorithm your server does not expect. ## Agent tokens Confirm how long a token lasts before you hand it to a long-running agent. ## Is it safe to paste a JWT here? The token is decoded by code on this page and is not sent to looot or anyone else. Still, treat a live token like a password: anyone holding it can use it until it expires. Prefer an expired or test token when you can. ## Does this JWT decoder verify the signature? No. Verifying needs the signing secret or the public key, and a secret should never be typed into a web page. Verify on your server with your JWT library, and pin the alg, iss and aud you expect. ## How do I decode a JWT? A JWT is three Base64URL parts joined by dots: header, payload and signature. Decode the first two and parse them as JSON. This page does that as you type. ## How do I check if a JWT has expired? Read the exp claim, a Unix time in seconds, and compare it with the current time. The page shows exp as a UTC date and says how long until or since it passed. ## What do iat, nbf and exp mean? iat is when the token was issued, nbf is the earliest time it may be used and exp is when it stops being valid. All three are Unix times in seconds. ## Why can anyone read my JWT payload? A signed JWT is encoded, not encrypted. The signature stops changes, not reading. Keep secrets out of the payload, or use an encrypted token (JWE). ## Can it decode an encrypted token (JWE)? No. A JWE has five parts and its payload needs the key to read. The page says so when it sees five parts. ## Does a Bearer prefix work? Yes. Paste the whole Authorization header value and the page drops the Bearer prefix and any line breaks. ## Related tools - /free-tools/base64-encoder-decoder - /free-tools/unix-timestamp-converter - /free-tools/json-formatter ## Last reviewed 2026-10-14.