What is a JSON Web Token (JWT)?

A JWT is a compact, URL-safe string used to securely transmit claims between parties. It consists of three Base64-encoded parts separated by dots: header (algorithm), payload (claims) and signature.

Does the JWT decoder verify the signature?

The decoder displays the header and payload without signature verification (verifying requires the secret or public key). Use the generator tab if you need to create and sign tokens.

Can I decode an expired JWT?

Yes. The decoder shows the raw payload including the 'exp' (expiry) claim regardless of whether the token is expired. Expiry is flagged visually in the decoded output.

Is my JWT sent to any server?

No. JWT decoding runs entirely in your browser — your token is never transmitted to GoChronos or any third party. This is safe even for tokens with sensitive payloads.

What signing algorithms does the JWT generator support?

HS256, HS384 and HS512 (HMAC-based symmetric algorithms) are supported for signing. RS256 is available for asymmetric signing with a private key.