JWT Decoder
Inspect token headers and claims, without verification.
Readable claims are untrusted data. Decoding does not establish the issuer, authenticity or permission to use a token.
ENCODED TOKEN
Paste a token to inspect its header and payload.
Enable JavaScript to decode locally. There is no server submission.
Decode is not verify.
Paste a three-part JSON Web Token, select Decode JWT, then inspect or copy its decoded header and payload. The signature is counted, never checked. Claims and algorithm names are untrusted statements from the token.
Times without guesswork.
exp, nbf and iat use Unix seconds, including fractional seconds. Dates show UTC and your browser’s local timezone; display precision stops at milliseconds. The comparison uses your device clock at decode time. A future expiration does not establish authenticity or authorization.
Private by construction.
Tokens stay in browser memory. Nothing is uploaded, logged or saved. Reset and leaving the tool clear the workspace. Copying a header or payload is an explicit clipboard action.
Useful distinctions.
Does this check the signature?
No. Verification requires a trusted key, allowed algorithms and application-specific claim checks. This tool only decodes readable content.
Why might a token not decode?
Use unpadded Base64URL and exactly three segments. Encrypted five-part tokens, invalid UTF-8, non-object JSON, duplicate member names, comments and excessive nesting are rejected. Only surrounding whitespace is removed.
Can I inspect an unsigned token?
Yes. Keep the last dot with an empty signature segment. The sample deliberately uses alg:none and synthetic claims; it is not a working credential.
Are decoded values changed?
Only whitespace is formatted. Number spelling, escapes and property order stay intact. Duplicate names are rejected because they make claims ambiguous. Raw claims remain visible even when a date cannot be interpreted.
What are the limits?
8 KiB of encoded token text, 16 JSON nesting levels and 64 Ki characters per decoded panel. These bounds keep inspection local and responsive. JWT decoding does not decrypt encrypted tokens.