About JSON Web Tokens

A JWT is three base64url-encoded sections joined by dots: a header naming the signing algorithm, a payload of claims (who the token is for, when it expires), and a signature over the first two. The content isn't encrypted — anyone holding a token can read it, which is exactly what this tool does.

What the signature adds is tamper-proofing: without the signing key, nobody can alter claims and produce a valid signature. That's also why this tool doesn't verify — verification needs the key, and a secret key should never be pasted into a website.

Decoding happens entirely in your browser. The token never leaves the page — worth knowing, because a real token pasted into the wrong online decoder is a leaked credential.