Question 1

Can this tool see the contents of my token?

Accepted Answer

No — the token is decoded entirely in your browser using base64url and JSON.parse. It's never sent to any server, which matters since a JWT's payload is only base64-encoded, not encrypted, and often contains sensitive claims.

Question 2

Can I verify the signature?

Accepted Answer

Yes, for HS256/HS384/HS512 tokens — paste the shared secret and the tool verifies the signature locally using the Web Crypto API. Asymmetric algorithms (RS256, ES256, etc.) can't be verified client-side without the issuer's public key, so those are decode-only.

Question 3

What do exp, iat, and nbf mean?

Accepted Answer

They're standard JWT claims expressed as Unix timestamps: iat is when the token was issued, exp is when it expires, and nbf ('not before') is the earliest time it becomes valid. This tool converts all three to readable dates automatically.

Question 4

Why does it say the token is malformed?

Accepted Answer

A JWT must have exactly three base64url segments separated by dots (header.payload.signature). If a segment is missing or contains invalid base64url characters, decoding fails before it ever reaches the signature check.

JWT Decoder

Frequently asked questions