Question 1

Does this tool verify the JWT signature?

Accepted Answer

No. This is a decoder only. Signature verification requires the secret or public key and must be done server-side. Never trust a decoded JWT without verification.

Question 2

Is it safe to paste my JWT here?

Accepted Answer

The token is processed entirely in your browser and never sent to Zovaty servers. However, JWTs are credentials — avoid pasting production tokens on shared machines.

Question 3

What does 'exp' mean?

Accepted Answer

exp is the expiration claim — a Unix timestamp after which the token must be rejected. The tool highlights expired tokens automatically.

Question 4

Why does decoding fail?

Accepted Answer

The token may be malformed, missing a segment, or use an invalid Base64url encoding. Ensure you copied the complete token with exactly two dots.