A JWT is not encrypted
Three Base64url segments separated by dots: header, payload, signature. The first two are merely encoded, so anyone holding the token can read every claim in it. The signature stops it being modified; it does not stop it being read.
So never put anything confidential in a payload. Roles and user IDs are fine; email addresses are questionable; anything you would not print on a postcard does not belong there.
Why this one decodes locally
A JWT is usually a live session credential. Pasting one into a site that sends it to a server hands that server the ability to act as the user until the token expires — and the popular online decoders do exactly that.
Nothing is transmitted here. It is worth checking the network tab yourself rather than taking anyone’s word for it, this page included.
Reading the claims
exp and iat are Unix timestamps in seconds; both are shown as dates here, because an expired token is the most common reason a request is suddenly rejected. sub is the subject, usually a user ID. iss and aud say who issued the token and who it is for — a service accepting a token issued for a different audience is a real vulnerability.
Decoding tells you what the token says. It does not tell you whether the signature is valid, which needs the key and belongs on the server.
Frequently asked questions
Can anyone read a JWT?
Yes. The header and payload are Base64url-encoded, not encrypted. The signature prevents tampering, not reading. Never put secrets in the payload.
Is my token sent anywhere?
No — it is decoded in your browser. That matters more here than almost anywhere: a live token lets whoever holds it act as you until it expires.
Does this verify the signature?
No. Verification needs the signing key, and a key pasted into a web page is a key you should now rotate. Verify on the server.
Why is my token rejected when it looks fine?
Check exp first — it is shown as a date here. After that, aud and iss: a token issued for a different audience is valid but not for that service.
Something wrong with this tool, or an idea for it? Tell us