JWT safety boundaries and three encoding dialects
Decoding is not authentication. A JWT is three Base64URL strings. This tool decodes with a strict base64url alphabet and then attempts JSON.parse; it has no key, performs no HMAC/RSA verification, and checks no issuer, audience or expiry policy. Every report therefore states "Decode only — signature is NOT verified" and labels exp/iat as unverifiedClaimTimes.
Damaged or non-JSON segments go into the errors array; the payload is shown verbatim as __rawText / __notJson. signatureVerification stays NOT_PERFORMED and signatureVerified stays false. Real verification belongs in a trusted server-side library with keys; this tool does not replace it.
Do not confuse three percent-encoding dialects: encodeURI targets a whole URL and preserves structural characters like : / ? & = #; encodeURIComponent targets one component and escapes those too; application/x-www-form-urlencoded (form) writes spaces as + and percent-encodes individual UTF-8 bytes. Only form decoding maps a literal + to a space, and %2B is resolved after that substitution, so it never becomes a space.
Timestamps follow the same discipline: seconds and milliseconds are two counts of one instant, Z denotes UTC, 1970-01-01T08:00:00+08:00 equals 0, and ISO strings without a zone are rejected to avoid an implicit local-time assumption.