JWT ٹوکن ڈی کوڈر

Encoded, not encrypted

A JSON Web Token is three parts separated by full stops: a header naming the algorithm, a payload of claims, and a signature. The first two are base64url — ordinary base64 with dash and underscore standing in for plus and slash, and the padding dropped — which means they are encoded rather than encrypted. Anyone holding the token can read every claim inside it, which is the single fact that matters most about the format before using the [msm_tool slug="jwt-decoder"] on anything real.

Decoding a token is not the same as verifying it

A payload that decodes cleanly and reads correctly is not evidence that the token is genuine. A forged token, built by anyone who understands the format, decodes exactly as cleanly as a real one — only checking the signature against the key it was signed with distinguishes the two, and that check needs a secret or public key that belongs on a server and should never be pasted into any web page, including this one.

The time claims are seconds, not milliseconds

`exp`, `iat` and `nbf` are all expressed in seconds since the epoch, which is a factor of a thousand away from what JavaScript's own `Date` expects by default. Feeding one of these values into `Date` without converting it first produces a date somewhere in 1970 rather than the intended expiry, which is a routine and easy mistake to make when reading a token by hand.

An expired token still decodes perfectly well

Nothing about the format itself prevents an expired token from being read — expiry is enforced by whatever system validates the token during a real request, not by the token's own structure. Decoding one that has already expired shows exactly what it claims and says nothing about whether any system would still accept it.

Nothing belongs in a payload that is not already public

Because the payload is readable by anyone who obtains the token, internal identifiers, roles and email addresses placed inside one are effectively visible to whoever is holding it, not protected in any meaningful sense. Anything genuinely sensitive needs to live somewhere the token merely references, not inside the token itself.

A token is a credential, even one you are only reading

Decoding happens entirely in the browser and nothing is transmitted anywhere by this tool, but a live, valid token grants whatever access it was issued for to anyone holding it. Pasting one anywhere — here or elsewhere — is worth exactly the same caution as pasting a password.