Quick reference
| Setting | Value / behavior |
|---|---|
| Segments | three |
| exp unit | Unix seconds |
| Signature | not verified |
How to use the result
A signed JSON Web Token commonly has three dot-separated segments: header, payload and signature. The first two are Base64URL-encoded JSON. Decoding shows their contents without requiring the signing key. This tool handles that three-part structure and displays the header and payload separately. Encrypted JWE tokens use a different structure and are not supported. JWT claims are often readable to anyone holding the token, even though the signature prevents undetected modification when properly verified.
Limits and interpretation
The result is explicitly unverified. It does not authenticate the sender, check the signature, enforce the expected algorithm, or validate issuer, audience and not-before requirements. An exp field is interpreted as Unix seconds and compared with the browser clock. That timing observation does not make a token valid. Do not paste real access tokens into shared computers or screenshots. For actual authentication, use a vetted JWT library with a trusted key source and application-specific claim validation.
Check against your destination
Run the supplied example first, then replace it with a representative input from your own workflow. Change one parameter at a time so the effect is easy to inspect. Copy or download the output and compare it with a small known case before using it in a larger system. A successful calculation establishes only the behavior described on this page; it cannot check the assumptions or access rules of a remote application. Errors are shown next to the workspace rather than silently returning an empty success.
Local processing and data handling
This tool runs in the browser and does not transmit the entered content to a processing service. No input is saved to local storage, added to the URL or synchronized to an account. The clear control removes the current field and displayed result from this page. Clipboard contents and downloaded files remain under your operating system’s control. Keep original inputs when exact byte preservation matters, and avoid including sensitive tokens or private text in screenshots that you later share.
Frequently asked questions
Does the tool contact my server?
No. It processes the provided input locally and does not execute commands on your systems.
Can I download the result?
Yes. Use the Download result control after a successful run.
What happens to my input?
It remains in this page until cleared or closed. It is not saved by the tool.
About this tool
Built and maintained by Mihai at Void Fabric. This page documents the behavior of the current implementation. Found an error or an unclear assumption? Send a reproducible example with sensitive values removed.
Reference: Void Fabric field notes · Testing and editorial policy