JWT Decoder

About JWTs

What is a JWT?

A JSON Web Token is three base64url-encoded parts joined by dots: a header (which algorithm and token type), a payload (the claims — arbitrary JSON data like a user id or expiry), and a signature. It's a compact, self-contained way to pass verifiable claims between systems, commonly used for auth tokens.

Does this tool verify the signature?

No — decoding and verifying are different operations. The signature is created by signing the header and payload with a secret key (HMAC algorithms like HS256) or a private key (RSA/ECDSA algorithms like RS256/ES256), and checking it requires that same secret or the matching public key. This tool only base64url-decodes the header and payload to show you their JSON content; it never asks for or handles a signing key, so it can't tell you whether a token is authentic — only what it claims.

Why do exp, iat, and nbf show as large numbers in the payload?

Per the JWT spec, timestamp claims (exp = expiry, iat = issued at, nbf = not valid before) are stored as NumericDate — whole seconds since the Unix epoch, not milliseconds. The raw payload JSON shows the spec-accurate number; the expires stat below converts exp into a readable date for convenience.

What does an 'invalid token' status mean?

A JWT must be exactly three dot-separated segments. That status means the input doesn't have that shape, or one of the header/payload segments isn't valid base64url-encoded JSON — for example if you pasted only part of a token, or something that isn't a JWT at all.

Does this tool upload my data anywhere?

No. Decoding happens entirely in your browser using standard Web APIs. Nothing you paste ever leaves your device — which also means it's safe to inspect real tokens here, though you should still never paste a signing secret or private key into any web tool.