Question 1

Is my JWT sent to any server?

Accepted Answer

No. This JWT decoder runs entirely in your browser using local JavaScript. Your token is never uploaded, logged, or transmitted anywhere — it never leaves your device. This makes it safe to paste production access tokens that contain sensitive data.

Question 2

Does this tool verify the JWT signature?

Accepted Answer

No. This tool only decodes the header and payload so you can read their contents. It does not verify the cryptographic signature, because verification requires the secret or public key that signed the token. A decoded JWT is not proof that the token is authentic or untampered.

Question 3

How does a JWT decoder work?

Accepted Answer

A JSON Web Token has three Base64URL-encoded parts separated by dots: header, payload, and signature. The decoder splits the token on the dots, Base64URL-decodes the header and payload segments, and parses each as JSON. The signature stays encoded because it can only be checked with the signing key.

Question 4

What do the exp, iat, and nbf claims mean?

Accepted Answer

These are standard registered JWT claims expressed as Unix timestamps (seconds since 1970). "iat" is when the token was issued, "exp" is when it expires, and "nbf" ("not before") is the earliest time it becomes valid. This tool converts them to human-readable dates and shows whether the token is currently valid, expired, or not yet valid.

Question 5

Why does my token show as expired?

Accepted Answer

The tool compares the token's "exp" claim against your device's current clock. If the expiry time has already passed, the token is shown as expired. Decoding still works for expired tokens — you can always read their contents — but most servers will reject an expired token.

Question 6

What JWT algorithms are supported?

Accepted Answer

Decoding is algorithm-agnostic: HS256, RS256, ES256, EdDSA and any other "alg" value all decode the same way, since the header and payload are just Base64URL-encoded JSON regardless of how the signature was produced. The tool displays the "alg" value from the header so you can see how the token was signed.

JWT Decoder

Frequently Asked Questions

From the blog

What's Inside a JWT: How to Decode and Debug JSON Web Tokens Safely