Question 1

What is the structure of a JWT?

Accepted Answer

A JWT has three dot-separated parts: header.payload.signature, each Base64URL-encoded. The header describes the algorithm and type, the payload carries the claims, and the signature is used for verification.

Question 2

Does this tool verify the signature?

Accepted Answer

No. This tool only decodes — it does not verify signatures, which would require a key and is out of scope. A decoded result does not mean the token is authentic.

Question 3

Is it safe to paste my token here?

Accepted Answer

Parsing runs entirely in your browser and nothing is uploaded. Still, avoid pasting production tokens into untrusted sites.

Question 4

What do exp / iat / nbf mean?

Accepted Answer

exp is the expiration time, iat the issued-at time, and nbf the not-before time, all Unix timestamps in seconds. After exp the token is invalid; before nbf it is not yet valid.