Read a JWT without trusting it
What the three segments of a JSON Web Token mean, which claims are time claims, and why decoding is not verification.
Three segments, two JSON objects
A signed JWT is header, payload, and signature, separated by dots. The first two segments are Base64url-encoded JSON. The third is the signature bytes. Anyone can decode the first two. That is why a payload is not a secret and not proof of who sent it.
The decoder on DevToolPilot stops at that read. It does not fetch a JWKS, does not try the alg none case as a success, and does not send the token anywhere.
Read the time claims against a clock
exp, nbf, and iat are seconds since the Unix epoch. The page shows the UTC time and a relative phrase such as in 3 days, using your computer's clock. A token that is not expired can still be forged, replayed, or intended for a different audience.
If you need to compare the number yourself, the Unix Timestamp Converter accepts the same seconds value and labels UTC and local time separately.