Is my JWT sent to a server?
No, absolutely not. All decoding and verification happens locally in your browser using JavaScript. Your sensitive tokens never leave your device.
What is a JWT?
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.
Can I edit the JWT here?
This tool is primarily for debugging and inspection. While you can see the decoded data, editing a signed JWT would invalidate its signature.
Why is my token 'Expired'?
If the 'exp' (expiration time) claim in your payload is in the past, the token is considered expired and should no longer be accepted by your API.
Does this tool verify the signature?
We display the signature part, but full cryptographic verification requires your private key or secret, which you should NOT paste into public web tools for security reasons.
What algorithms are supported?
We decode any standard JWT regardless of algorithm (HS256, RS256, etc.) since decoding the payload doesn't require the key.
What is the structure of a JWT?
A JWT consists of three parts separated by dots (.): Header, Payload, and Signature.
How do I fix 'Invalid Signature'?
This usually means the content has been tampered with or the wrong secret key was used to sign it. Ensure your backend uses the correct key.
Is Base64 decoding the same as encryption?
No. Base64 encoding is reversible by anyone. Do not put sensitive secrets (like passwords) inside a JWT payload.
Can I use this for production tokens?
Yes, for debugging purposes. Since it's client-side, it's safe, but always be cautious with production credentials.