Question 1

Is JWT decoding safe? Does this tool send my token anywhere?

Accepted Answer

Yes, it is completely safe. JWT decoding happens entirely in your browser — the token never leaves your device. No data is sent to any server. The tool simply base64-decodes the header and payload of the token and displays the JSON content locally.

Question 2

Does this tool verify the JWT signature?

Accepted Answer

No, this tool does not verify the cryptographic signature. It only decodes and displays the three parts of a JWT: header, payload, and signature. Signature verification requires the secret or public key, which this browser-only decoder does not have access to — by design, for your security.

Question 3

What is the difference between decoding and verifying a JWT?

Accepted Answer

Decoding a JWT means reading the base64-decoded content of the header and payload — anyone can do this with any JWT. Verifying a JWT means checking the cryptographic signature against the header and payload using a secret key (HMAC) or public key (RSA/ECDSA) to ensure the token has not been tampered with. This tool performs decoding only, not verification.

Question 4

What do exp and iat mean in a JWT payload?

Accepted Answer

exp (expiration) is the timestamp after which the token is no longer valid. iat (issued at) is the timestamp when the token was created. Both are Unix timestamps in seconds. This tool automatically converts them to human-readable dates and indicates whether the token has expired.

Question 5

What are the three parts of a JWT?

Accepted Answer

A JSON Web Token consists of three parts separated by dots: 1) Header — contains the signing algorithm (e.g., HS256, RS256) and token type (JWT). 2) Payload — contains the claims (data) like sub, name, iat, exp. 3) Signature — a cryptographic hash of the encoded header and payload, used to verify the token's integrity.

Kas ir JWT un kā to dekodēt

Bieži uzdotie jautājumi

Vai JWT dekodēšana ir droša? Vai šis rīks nosūta manu marķieri kaut kur?

Vai šis rīks pārbauda JWT parakstu?

Kāda ir atšķirība starp JWT dekodēšanu un verifikāciju?

Ko nozīmē exp un iat JWT datu lodzē?

Kādas ir trīs JWT daļas?

JWT Decode