Question 1

Does decoding a JWT prove the token is valid?

Accepted Answer

No. Decoding only Base64URL-decodes the header and payload. Validating a JWT requires checking the signature with the correct secret or public key and then verifying claims such as exp, nbf, iss, and aud.

Question 2

Is it safe to paste a production JWT?

Accepted Answer

The tool decodes locally in the browser, but a production token can still contain account IDs, scopes, emails, or session data. Redact sensitive values before sharing screenshots or copied output.

Question 3

Why do JWT expiration times look different from JavaScript timestamps?

Accepted Answer

JWT time claims use NumericDate seconds since the Unix epoch. JavaScript Date values often use milliseconds, so the value must be converted before comparing times.

Decodificador JWT e inspector de claims

JWT decodificado

Como usar

Preguntas frecuentes