What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token used mainly for authentication and information exchange. It has three Base64url-encoded parts separated by dots: header.payload.signature. The header describes the token type and signing algorithm; the payload carries claims like user ID, roles, and expiry; the signature lets a server verify the token wasn't tampered with.
Is decoding the same as verifying?
No. The header and payload are only Base64url-encoded, not encrypted, so anyone can decode and read them without a secret key — that's what this tool does. Verifying a JWT means checking its signature against the issuer's secret or public key, which proves the token wasn't altered. This tool intentionally does not verify signatures, since that requires a key this page never has.
Frequently asked questions
Why shouldn't I trust a decoded JWT without verifying it?
Anyone can craft a JWT with any payload they want — decoding just reveals what's claimed, not whether it's genuine. A server must always verify the signature before trusting the claims inside.
What does the "exp" claim mean?
exp is a standard claim holding the token's expiry as a Unix timestamp (seconds since 1970-01-01). Past that time, a correctly-implemented server should reject the token even if the signature is valid.
Is my token uploaded when I use this tool?
No. Decoding happens instantly in your browser using built-in JavaScript functions — the token is never sent to a server. Still, treat real tokens as sensitive and avoid pasting production credentials into any third-party tool, including this one.