Util Tools What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token used to carry claims between parties, most often for authentication and authorization. It has three Base64url-encoded parts separated by dots: a header (the algorithm and token type), a payload (the claims, such as user ID and expiry), and a signature that proves the token has not been altered.
Decoding is not the same as decryption
The header and payload of a standard JWT are only Base64url-encoded, not encrypted, so anyone can read them. This tool decodes them for inspection. The important consequence: never put secrets in a JWT payload, because it is effectively public. What the signature provides is integrity, the assurance that the contents were not tampered with, not confidentiality.
Checking expiry and the alg field
The payload usually includes an exp claim, a Unix timestamp after which the token is invalid;
this decoder shows whether the token has expired. The header's alg field names the signing
algorithm, such as HS256 (a shared secret) or RS256 (a public/private key pair). Verifying that alg is what
you expect is an important security check, since attacks have exploited servers that trusted the token's own
stated algorithm.
Is it safe to decode a JWT here?
Yes. This decoder runs entirely in your browser, and signature verification (HS256/RS256) is performed locally. Nothing is transmitted to a server. Still, treat any production token as a live credential: decode it to debug, but do not paste tokens into untrusted tools, and rotate any token you suspect has been exposed.
Last updated: July 2026