Question 1

Is JWT decoding safe? Does this tool send my token anywhere?

Accepted Answer

Yes, it is completely safe. JWT decoding happens entirely in your browser — the token never leaves your device. No data is sent to any server. The tool simply base64-decodes the header and payload of the token and displays the JSON content locally.

Question 2

Does this tool verify the JWT signature?

Accepted Answer

No, this tool does not verify the cryptographic signature. It only decodes and displays the three parts of a JWT: header, payload, and signature. Signature verification requires the secret or public key, which this browser-only decoder does not have access to — by design, for your security.

Question 3

What is the difference between decoding and verifying a JWT?

Accepted Answer

Decoding a JWT means reading the base64-decoded content of the header and payload — anyone can do this with any JWT. Verifying a JWT means checking the cryptographic signature against the header and payload using a secret key (HMAC) or public key (RSA/ECDSA) to ensure the token has not been tampered with. This tool performs decoding only, not verification.

Question 4

What do exp and iat mean in a JWT payload?

Accepted Answer

exp (expiration) is the timestamp after which the token is no longer valid. iat (issued at) is the timestamp when the token was created. Both are Unix timestamps in seconds. This tool automatically converts them to human-readable dates and indicates whether the token has expired.

Question 5

What are the three parts of a JWT?

Accepted Answer

A JSON Web Token consists of three parts separated by dots: 1) Header — contains the signing algorithm (e.g., HS256, RS256) and token type (JWT). 2) Payload — contains the claims (data) like sub, name, iat, exp. 3) Signature — a cryptographic hash of the encoded header and payload, used to verify the token's integrity.

Was ist JWT und wie dekodiert man es

Häufig gestellte Fragen

Ist JWT-Decodierung sicher? Sendet dieses Tool meinen Token irgendwohin?

Überprüft dieses Tool die JWT-Signatur?

Was ist der Unterschied zwischen Dekodieren und Verifizieren eines JWT?

Was bedeuten exp und iat im JWT-Payload?

Was sind die drei Teile eines JWT?

JWT Decode