123024.com · JWT
A JWT (JSON Web Token) has three parts — Header, Payload, and Signature — separated by dots. It is widely used for auth and claim passing. This tool decodes the first two segments and can encode claims with a selected algorithm for local debugging.
Header usually declares token type and signing algorithm (e.g. HS256, RS256). Payload carries subject id, exp, iat, and custom business claims. Signature verifies the token was not tampered with and needs a secret or public key to validate.
Decoding Header/Payload is not the same as verifying the signature. Being able to “read” the content does not mean the token is valid. In production, always use a trusted library for signature and claim checks.
Do not leave real production secrets pasted on untrusted devices. Conversion here runs locally, but shared machines, screen recording, or browser extensions can still leak data. For expiry issues, focus on exp, nbf, and iat.