Question 1

What is a JWT token?

Accepted Answer

JWT (JSON Web Token) is an open standard for securely transmitting information as a JSON object. A JWT has three Base64URL-encoded parts separated by dots: header (algorithm and type), payload (claims), and signature.

Question 2

How do I decode a JWT token?

Accepted Answer

Paste your JWT token into the decoder above. The tool instantly splits it into header and payload, Base64URL-decodes each part, and displays the JSON content with syntax highlighting and claim annotations.

Question 3

Is JWT decoding safe?

Accepted Answer

Yes. JWT decoding is safe because the header and payload are only Base64URL-encoded, not encrypted. This tool decodes entirely in your browser — no token data is ever sent to a server.

Question 4

Can this tool verify the JWT signature?

Accepted Answer

No. Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA). This tool only decodes the header and payload — it does not verify the signature.

Question 5

What JWT claims are shown?

Accepted Answer

The decoder annotates all standard JWT claims: iss (Issuer), sub (Subject), aud (Audience), exp (Expiration Time with valid/expired status), nbf (Not Before), iat (Issued At), and jti (JWT ID).