How a JWT is put together
A JWT has three parts separated by dots: header.payload.signature. The Header and Payload are JSON objects encoded in Base64URL — not encrypted — and the Signature is generated from them using a secret key (or a key pair), guaranteeing the content hasn't changed since it was issued.
Decoding isn't the same as verifying
Because the Header and Payload are only encoded, not encrypted, any tool can decode them without needing any key — including this one. Verifying the signature is a different operation, one that requires the key used to sign the token, and it isn't performed here.
Frequently Asked Questions
What is a JWT (JSON Web Token)?
It's a compact format for transmitting signed information between two parties, widely used for authentication. A JWT is made up of three parts separated by dots: Header, Payload, and Signature, each encoded in Base64URL.
Does this tool verify the token's signature?
No. The tool only decodes the Header and Payload, which are not encrypted, just Base64URL-encoded. It does not confirm whether the signature is valid or whether the token is authentic, since that would require the secret or public key used to sign it.
Is the token I paste here saved anywhere?
No. Decoding happens entirely in your browser, without sending the token to any server.
Why shouldn't a JWT payload contain sensitive information?
Because the payload isn't encrypted, only Base64URL-encoded — anyone with access to the token can decode it and read its contents, exactly like this tool does. The signature only guarantees the content hasn't been tampered with, not that it's hidden.
