What a JWT is

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties — typically a user identity and access metadata passed from an auth server to an API. Defined in RFC 7519, it's three Base64URL-encoded segments separated by dots: header.payload.signature.

• The header declares the signing algorithm (e.g. HS256, RS256) and token type.
• The payload is a JSON object of claims — sub (subject / user id), exp (expiry), iat (issued-at), iss (issuer), aud (audience), plus any custom claims (role, email, etc.).
• The signature is HMAC_SHA256(base64url(header) + '.' + base64url(payload), secret) (for HS-family) or an RSA/ECDSA signature (for RS/ES-family).

The payload is not encrypted — anyone can Base64-decode it. The signature is what proves the token wasn't tampered with.

What this tool does

• Decode any JWT into its three parts. Pretty-print the header and payload JSON.
• Highlight standard claims (exp, iat, nbf, iss, aud, sub, jti) with human-readable timestamps and expiry status.
• Verify the signature for HS256 / HS384 / HS512 by pasting your secret. RS/ES verification (RS256 / ES256) requires a public key in PEM form.
• Detect common red-flags — alg: none (signature bypass attack), missing exp, very long-lived tokens.
• All client-side. Your token and your secret stay in your browser. No upload.

Why developers reach for this daily

A JWT decoder is the single most-used tool in auth debugging. When a request 401s, the first move is to decode the token and check: is it expired? Does the aud match this service? Does the role/scope claim include the action being attempted? Is the issuer correct? Five seconds with a JWT decoder saves an hour of guessing.

The ecosystem standard is jwt.io. This tool does the same job but: (a) never sends your token over the wire (jwt.io does decode client-side now too, but it's still hosted on a third-party domain), (b) flags the common security smells inline, and (c) is one keystroke away from the rest of the Toolenza dev kit via Cmd-K.