Question 1

Is decoding a JWT here safe for tokens containing real user data?

Accepted Answer

Every calculation runs entirely in your browser using standard JavaScript — nothing you paste is sent to a server or logged anywhere. That said, a JWT payload is not encrypted, only encoded, so anyone who has the token can already read its contents; be mindful of where you paste real tokens regardless of which tool you use.

Question 2

Can this verify a JWT's signature?

Accepted Answer

No — this tool decodes the header and payload (which are just Base64URL-encoded JSON) but does not verify the signature, which requires the issuer's secret key or public key. A token can be decoded and read without that key, but you cannot use this tool to confirm the token hasn't been tampered with.

Question 3

What is the difference between Base64 and URL encoding?

Accepted Answer

Base64 converts arbitrary binary or text data into a compact set of 64 printable characters, commonly used for embedding data in JSON, JWTs, or data URLs. URL (percent) encoding instead escapes characters that aren't safe in a URL — spaces, "&", "?", and others — by replacing them with a "%" followed by their hex code. They solve different problems and are not interchangeable.

Question 4

Why does decoding sometimes fail with an error?

Accepted Answer

Base64 decoding fails if the input contains characters outside the standard alphabet (A–Z, a–z, 0–9, +, /) or is missing required padding ("=") at the end. URL decoding fails if a "%" appears without two valid hex digits after it. JWT decoding fails if the token doesn't have exactly three dot-separated parts, or if a segment isn't valid Base64URL-encoded JSON.

Question 5

What are the "iat" and "exp" claims shown for a JWT?

Accepted Answer

"iat" (issued at) and "exp" (expiration) are standard JWT claims storing a Unix timestamp — seconds since January 1, 1970. This tool converts both to a readable date automatically and flags whether the token's expiry has already passed, which is a common first thing to check when debugging an authentication issue.

Claim	Meaning
sub	Subject — usually the user or account ID
iat	Issued-at timestamp
exp	Expiration timestamp

Base64 / URL / JWT Encoder & Decoder

What each mode does

Decoding a JWT payload

Common questions