JWT Decoder Documentation

Decode readable JWT headers and payloads locally without verifying signatures.

Splits a three-part readable token, decodes its unpadded Base64URL header and payload as JSON objects, and displays them locally. A finite numeric exp claim is compared to the device clock, including epoch zero. Expiry status is explicitly unverified; the signature is not checked.

• Inspect claim names in a synthetic development token.
• Check whether an exp value uses numeric Unix seconds.
• Identify an unsigned alg none token without trusting its contents.

Input

Text, files, or values entered in the browser, depending on the tool.

Output

A result shown in the browser that can be reviewed or copied where supported.

• Does not verify signatures, issuer, audience, not-before claims, revocation, or authorization. Never use the displayed status as an authentication decision.
• Only readable three-part JSON-object tokens are supported, not encrypted five-part JWE. Header and payload must use unpadded Base64URL.
• Input is capped at 100,000 characters. Expiry comparisons depend on the device clock and JavaScript Date range.

Inputs for this browser-side tool are processed locally and are not sent to SiteIndex. Normal page analytics may still be collected as described in the Privacy Policy. Read the Privacy Policy.