Developer tools
Paste a JWT to see its header and claims, check whether it has expired, and optionally verify an HMAC signature with your secret.
Header
Payload
Paste the token (the three dot-separated parts).
Read the decoded header and payload; dates such as exp and iat are shown in your time zone.
To check the signature of an HS256/384/512 token, enter the secret.
The token is decoded in your browser and never sent anywhere. Still, treat production tokens like passwords and prefer expired or test tokens.
Yes. The header and payload are only Base64URL-encoded, not encrypted. The signature only proves the token was not changed, so never put secrets in the payload.
A 502 page tells you nothing. It means Nginx asked PHP-FPM for a response and either...
You defined a scheduled task, deployed, and nothing happens. No error, no log line, no email....
Last updated: 9 November 2026. See the update log at the end.The classic Laravel deployment bug...
We use cookies to improve your experience and analyze traffic. By continuing, you agree to our Privacy Policy.
