Question 1

What is a JWT?

Accepted Answer

A JSON Web Token (JWT) is a compact, URL-safe token format used to securely transmit information between two parties as a JSON object. It consists of three Base64URL-encoded parts separated by dots: a Header (algorithm & type), a Payload (claims/data), and a Signature. JWTs are widely used for API authentication and session management.

Question 2

Can FileMint verify a JWT signature?

Accepted Answer

Yes — if you provide the secret key used to sign the token, the tool will verify the HS256 signature and display whether it is valid. Without the secret key, the tool still decodes and displays the header and payload claims, but cannot confirm the signature is authentic.

Question 3

Is it safe to paste my JWT into this tool?

Accepted Answer

Yes. FileMint's JWT tool is 100% client-side — your token is processed entirely within your browser's JavaScript engine and is never sent to any server. However, as a general security practice, avoid sharing production tokens with any online tool if they grant access to sensitive resources.

Question 4

What is the difference between JWT and Base64?

Accepted Answer

Base64 is a simple binary-to-text encoding with no security. JWT uses Base64URL encoding for its parts, but adds a cryptographic signature to ensure the payload has not been tampered with. A JWT is not encrypted — the payload is readable by anyone who has the token — but it cannot be modified without invalidating the signature.

Question 5

What JWT algorithms are supported?

Accepted Answer

The FileMint JWT Encoder currently supports HS256 (HMAC-SHA256), which is the most widely used algorithm for symmetric signed JWTs. The decoder can display the header of any JWT regardless of algorithm (HS256, RS256, ES256, etc.), though signature verification is only available for HS256.

JWT Decoder / Encoder

What is JWT Decoder & Encoder?