What is a JWT?
A JSON Web Token has three parts separated by dots: a header (which algorithm signed it), a payload (the claims, such as user ID and expiry) and a signature. The header and payload are only base64url-encoded, so anyone holding the token can read them.
Common claims
sub— subject, usually the user ID.iat— issued-at time (Unix seconds).exp— expiry time. After this, servers should reject the token.nbf— not-before time.iss/aud— who issued the token, and who it is for.
Does this verify the signature?
No — this tool decodes only. Verifying needs the secret or public key, which should stay on your server. Because decoding happens in your browser, it is safe to inspect real tokens here, but never paste production tokens into tools that send them to a server.