Signature not verified. Decoded claims are untrusted.
Choose Decode and paste a complete token with three dot separated parts. Read the decoded header and payload, then check the algorithm and any expiration shown. The example below decodes a small test payload; its signature segment is deliberately just test bytes. A readable payload does not establish who issued the token or whether it is trustworthy. Decoding here does not verify signatures.
Choose Encode when you need a testing token, supply valid JSON and a secret, and select HS256, HS384, or HS512. These are the supported HMAC signing algorithms. Do not paste production secrets into a shared example. JWT payloads are encoded rather than encrypted, so anyone holding the token can read them. Keep sensitive records on your server and reference them with identifiers instead.
Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZGEifQ.dGVzdA
Decoded header: {"alg":"HS256","typ":"JWT"}
Decoded payload: {"sub":"ada"}
Signature: not verified
A JWT (JSON Web Token) is a compact token format used for authentication. It has three Base64URL-encoded parts separated by dots: the header (algorithm and type), the payload (claims like user ID and expiration), and the signature (cryptographic proof the token hasn't been tampered with).
Processing runs in your browser. Choosing Share uploads the selected tool state; anyone with the link can open it. Signing in to save sends content to your account library and records save history. Review the selection before either action. Closing the page does not delete those copies. Copying locally does not create a server share.
HS256 uses a shared secret key (symmetric) β both the creator and verifier need the same secret. RS256 uses a public/private key pair (asymmetric) β the creator signs with a private key and anyone can verify with the public key. Use RS256 for public APIs.
The numeric exp claim is compared with the current time. Expiration is unverified claim data and does not prove that the token is authentic. Decoding alone does not verify the signature.
Signs with HMAC HS256, HS384 and HS512; decoding does not verify signatures.