JWT Tools

A JSON Web Token is three Base64URL-encoded segments joined by dots — a header (algorithm and token type), a payload (claims: whatever data the issuer put in), and a signature (proof the first two segments haven't been tampered with, computed with a secret or private key only the issuer holds). The Decoder in this category splits a token into those three parts and shows you the header and payload as readable JSON, along with the expiry claim rendered as a relative time and warnings for two specific red flags: an algorithm of none (a token with no signature at all — historically exploitable when a server accepts it) and a token that's already expired.

The distinction that matters most here is decoding is not verifying. Anyone can Base64-decode a JWT's header and payload without any key at all — that's by design, since JWTs are meant to be inspectable, not confidential. What decoding does not tell you is whether the signature is actually valid for the claimed algorithm and the actual signing key, which is the only thing that proves the token wasn't forged or modified after issuance. This tool decodes for inspection and debugging — reading what a token claims, checking whether it's expired, confirming which algorithm it says it uses — not for authenticating a token as trustworthy. A backend that trusts a JWT's payload without verifying its signature server-side, using the real secret, has a hole an attacker can drive through by handing it a token with a modified payload and a signature that was never checked.

A second, related trap is where verification is allowed to happen at all. Client-side JavaScript can decode a JWT freely, but it should never be the thing deciding whether that token is trusted — a browser is a hostile execution environment from the server's point of view, and any check performed there can be skipped by an attacker calling your API directly. Signature verification belongs on the server, or in a client that holds the actual public key for an asymmetric algorithm like RS256 and treats it purely as a local sanity check, not as authorization. This category has exactly one tool for exactly that reason: decoding and inspection is the safe, generally useful operation to expose in a browser tool; signature verification against a secret you'd have to paste in is a much narrower, higher-risk workflow that doesn't belong in a shared client-side utility.