What's inside a JWT (and what this decoder does)
A practical look at JWT header, payload, and signature — plus why QSTools only decodes in the browser.
A JWT is three Base64URL segments joined by dots: header.payload.signature. Anyone who holds the token can read the first two segments. The signature is meant to prove integrity — it is not encryption.
What QSTools shows you
Our JWT Decoder pretty-prints header and payload in your browser. The token never leaves the device for this step. We intentionally do not verify the signature here: verification needs your secret or public key, and keeping that workflow separate avoids false confidence.
Common claims people actually check
alg/typin the headersub,iss,aud,exp,iatin the payload- Custom claims your API added
If decode fails, it is usually a truncated paste, a non-Base64URL character, or a segment that is not JSON after decode.
Weekly writing note
We publish short, original notes tied to the tools — not mirrored docs from jwt.io or vendor blogs. Facts about the JWT format are shared industry knowledge; the wording, examples, and product angle here are ours.