Question 1

Does my token get sent to a server?

Accepted Answer

No. The decoding is string work and the signature check runs through crypto.subtle, both inside the page you are looking at. Nothing about the token or the key leaves the browser, which matters because a live access token is a credential: anyone holding it can act as you until it expires.

Question 2

What is the difference between decoding a JWT and verifying it?

Accepted Answer

Decoding is reading. The header and payload are base64url, not encryption, so anyone can see the claims without a key at all. Verifying is recomputing the signature over the first two sections and comparing it, which is the only step that proves the claims were not edited after the issuer signed them. A decoder that stops at reading tells you what a token says, not whether to believe it.

Question 3

Which algorithms can it verify?

Accepted Answer

HS256, HS384 and HS512 with the shared secret, and RS256/384/512, PS256/384/512 and ES256/384/512 with the public key. Paste an SPKI PEM block or a single JWK object. If you have a whole JWKS, take the key whose kid matches the kid in the token header.

Question 4

It says the signature does not match. What now?

Accepted Answer

Three things cause nearly all of them. The key is from a different environment than the token, which is easy when staging and production share a codebase. The secret was stored base64-encoded and needs the Base64 setting rather than plain text. Or the token really was modified, which is exactly what the check is for. A key from the wrong issuer usually fails to import instead, and you get an error about the key rather than a mismatch.

Question 5

What does the "unsigned token" warning mean?

Accepted Answer

It means the header claims alg is "none", or the signature section is empty. Such a token is a JSON object with dots in it: anyone can change the payload, add admin true, and it will still parse. Historically some libraries accepted these by default, which is why the alg in a token must never decide how it gets verified. Pick the algorithm from your own configuration and reject anything else.

Question 6

Why is my exp shown as a date fifty thousand years from now?

Accepted Answer

Because it was written in milliseconds. RFC 7519 defines exp, nbf and iat as NumericDate, a count of seconds since 1970, so a value from Date.now() is a thousand times too large. The tool flags it rather than quietly displaying the year 57000, since the practical effect is a token that never expires.

Question 7

Can it read an encrypted token?

Accepted Answer

No, and it will tell you so. A JWE has five sections instead of three and its payload is ciphertext, so without the decryption key there is nothing to display. Count the dots: four means encrypted, two means signed.

tooldura

JWT Decoder

About JWT Decoder

How to use JWT Decoder

Frequently Asked Questions