Does this JWT debugger verify signatures?

No. It decodes the compact structure and displays the signature segment without claiming authenticity.

JWT Debugger – Decode JWT Header, Payload & Claims

Q: Is my JWT uploaded or stored?

No. JWT decoding happens locally in the browser, and token contents are not added to URLs or persisted by the tool.

Q: What do exp, nbf, and iat mean?

They are NumericDate claims for expiration, earliest acceptable use, and issuance time, measured in Unix seconds.

Q: Why is alg none highlighted?

It denotes an unsecured JWT with no cryptographic signature and should not be accepted where authentication is required.

Decode a JWT without uploading it

A JSON Web Token is a compact string made from three Base64URL segments: a header, a payload, and a signature. This debugger decodes the first two segments in your browser, explains familiar claims, and maps time-based claims onto a practical timeline. The token is not sent to the iLoveTools.LoL server, added to a URL, or saved between sessions.

How JWT decoding works

The compact form is header.payload.signature. The header and payload are Base64URL-decoded as UTF-8 and parsed as JSON objects. Decoding makes the data readable; it does not establish that the data is authentic.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.
eyJzdWIiOiJ1c2VyXzQyIiwiZXhwIjoxNzM1Njg5NjAwfQ
.
signature-bytes

Header

Usually names an algorithm with alg, a type with typ, and sometimes a key selector such as kid.

Payload

Contains registered claims such as iss, sub, aud, iat, nbf, and exp, plus application-specific claims.

Signature

Can protect integrity only when a verifier uses an allowed algorithm, the correct key, and strict claim validation.

NumericDate

JWT time claims use seconds since the Unix epoch. The debugger shows both local time and UTC for easier incident analysis.

Decoding is not verification

A decoded token can still be forged, expired, intended for another audience, issued by an untrusted party, or signed with an unacceptable algorithm. Production authentication code must verify the signature and independently validate the algorithm, issuer, audience, expiration, not-before time, and any application-specific authorization rules.

JWT safety checklist

Allow only algorithms your service explicitly supports; never trust the token to choose security policy.
Require and validate exp, and allow only a small, deliberate clock-skew tolerance.
Validate iss and aud against exact expected values.
Treat kid, jku, and certificate URLs as untrusted input.
Keep passwords, API keys, access tokens, and other secrets out of readable JWT payloads.
Prefer short lifetimes and a revocation or rotation strategy appropriate to the risk.

Frequently asked questions

Is my JWT uploaded or stored?

No. The Vue interface decodes the token locally in your browser. Token contents are not submitted to Laravel, added to the page URL, or persisted by this tool.

Does a readable payload mean the JWT is insecure?

JWT payloads are normally encoded rather than encrypted, so readability is expected. Security depends on correct signature verification, claim validation, transport protection, and avoiding sensitive payload data.

Does this tool verify the signature?

No. This debugger intentionally separates decoding from trust. It displays the signature segment but does not accept a secret or public key and does not claim that the token is authentic.

What do exp, nbf, and iat mean?

exp is the expiration time, nbf is the earliest acceptable time, and iat records when the token was issued. Each is a NumericDate measured in Unix seconds.

Why is alg none highlighted?

alg: none denotes an unsecured JWT with no cryptographic signature. It should not be accepted by systems that require authenticated tokens.

Can I inspect a malformed or expired token?

Yes. Malformed segments receive a targeted error, while structurally valid expired or future tokens remain readable and are clearly labeled by their time-claim status.