Q: Is my data secure?
Yes. All processing happens entirely in your browser. No data is ever sent to any server. However, avoid pasting production tokens with sensitive data into any online tool.
Q: Does this validate JWT signatures?
No. This tool only decodes and displays the JWT header and payload. It does not verify the signature, as that would require the signing key or public key. Use server-side libraries for signature validation in production.
Q: What JWT claims are recognized?
The tool recognizes all standard registered claims including iss (Issuer), sub (Subject), aud (Audience), exp (Expiration), nbf (Not Before), iat (Issued At), and jti (JWT ID). Timestamp claims are automatically converted to human-readable dates.
Q: What algorithms are displayed in the header?
The tool displays the algorithm (alg) field from the JWT header, which typically includes HS256, HS384, HS512 (HMAC), RS256, RS384, RS512 (RSA), ES256, ES384, ES512 (ECDSA), and others as specified in the token.