Questions people ask before they paste
Yes, decoding is local. No, that does not make a leaked prod token safe. If the payload has PII, you already exposed it to your screen, your shoulder, and your screenshot tool. This page exists so you can inspect structure without shipping the token to a random API. It is still a microscope, not a safe.
What a JWT actually is
Three base64url segments: header, payload, signature. This tool decodes the first two and leaves the signature as bytes you can stare at. It does not check HS256 with your secret. That would require typing the secret into a webpage, which is how incidents get blog posts. Encoding is not encryption. Anyone who has the token can decode the payload the same way.
Worked example: the documentation token
Paste the classic jwt.io example token. Header says HS256. Payload has sub/name/admin. You learn the shape. You do not learn whether a server would accept it. If alg ever reads none, that is a verifier bug waiting to happen in someone else’s code, not a feature of this decoder.
Worked example: expired claim
If exp is in the past, the UI still decodes. Servers should reject; this page will not. Same for nbf and aud. Use expiry as a clue for “why did the client retry,” not as a gate.
Worked example: do not paste a customer token
Support Slack fills with JWTs because they are easy to copy. So do breach reports. If you must decode a customer token, do it locally, redact the screenshot, and rotate if it ever hit a ticket system. Browser extensions can read this page. Shared Zoom can read this page. The tool not uploading the token does not make the rest of your computer a vault.
Mistakes
Assuming “decoder = verifier.” Logging JWTs in application logs. Editing claims here and expecting production to honor them (use the generator for fixtures only). Forgetting that JWE is encrypted and is not this tool.
Deep dive
The longer version of the trust boundary is JWT in your tab vs jwt.io: same base64url algebra, different third-party scripts. View source here; signature shown and not checked.
Questions
Is decoding the same as verifying?
No. Verification needs the secret or public key and a crypto check. This page only decodes.
Does the token leave my machine?
Not via this tool’s JS. Browser extensions are outside my control.
Why show the signature?
So you can see it exists. Sharing signatures still leaks structure.
Can I edit claims here?
Use the JWT generator for experiments. Do not resign prod tokens in a browser toy.
What about encrypted JWTs (JWE)?
Not supported. Different beast.
Is base64url safe to log?
Payloads often hold PII. Logging JWTs is a classic breach pattern.