JWT Decoder
Inspect a compact JSON Web Token (JWT) locally, with a clear boundary between readable claims and verified trust.
Decoded for inspection — signature not verified
Unsecured / no signature. These claims are not trusted.
A readable JWT payload does not prove signing, issuer, audience, expiry acceptance, or authorization. The displayed alg is not executed; no algorithm is supported for verification on this page.
- Token shape
- Three-part compact JWS
- Header alg (untrusted)
- Signature segment
JOSE header
Claims payload
Registered claims
Raw claim values are untrusted. NumericDate values are seconds since 1970-01-01 UTC; the browser-local display includes its time zone.
No registered claims are present. Other claims remain visible in the payload JSON.
Export note: Claims can be sensitive. Copied text and the local JSON report include the unverified warning, but omit the raw compact token and signature bytes.
Decode is not verification
A JWT can carry readable JSON claims in a compact, period-separated form. Reading those claims does not show who issued the token, whether the signature is correct, whether your application accepts its audience or whether an expiration claim should be honored. This page deliberately asks for no key and performs no signature verification. Its result is an inspection aid, never an authentication result.
What the inspector reads
The first segment is a JOSE header, the second is a JSON claims payload and the third is an opaque signature segment. The tool requires canonical, unpadded Base64URL encoding and fatal UTF-8 for the first two parts; malformed encodings, duplicate top-level claim/header names and unsupported critical or unencoded-payload shapes receive a recoverable error. A five-part encrypted JWE is identified but not decrypted. Nested JWTs are outside this version.
The alg field is displayed as an untrusted header claim, not executed. A signature segment's presence and byte length are shown without interpreting its bytes. An alg=none token with an empty signature is labeled unsecured. Unknown algorithms are not verified either.
Registered claims and time zones
The claim view explains iss, sub, aud, exp, nbf, iat and jti. Other claims remain visible as inert JSON. NumericDate numbers for exp, nbf and iat are interpreted as seconds since the Unix epoch, including representable fractional or negative seconds. The same row shows the original number, ISO UTC instant and browser-local time with zone. Strings or numbers outside the browser Date range stay raw and receive a note. No date display is an authorization verdict.
Keep tokens private
A bearer token may grant access to an account or reveal personal claims. Use a synthetic token for learning, and avoid sharing real production tokens. This route loads first-party page assets but no third-party ad, analytics, tag or replay script, and no remote task-processing code. Input is not placed in a URL, form action or browser storage. Copies and the local JSON report include an unverified warning, omit the raw compact token and signature bytes, and leave this tab only when you choose a copy or download action. Clear removes visible state, not a guarantee of secure memory erasure.
Frequently asked questions
Does decoding a JWT verify its signature?
No. A compact JWT's header and claims can be read without the signing key. This page never verifies signatures or authenticates a user, issuer, audience or application policy. Treat every displayed claim as untrusted data.
Why are there three parts, and what is Base64URL?
A compact signed JWT (JWS) has an encoded JOSE header, encoded payload and signature segment separated by periods. Base64URL uses URL-safe - and _ characters. It is encoding, not encryption. A five-part JWE is encrypted and cannot be decoded by this inspector.
What do exp, nbf and iat mean?
They are registered NumericDate claims: seconds since 1970-01-01T00:00:00Z. This page shows raw seconds, an ISO UTC instant and a clearly labeled browser-local time and zone. Dates are unverified claims, not a verdict that a token is currently acceptable.
What does alg=none mean?
A three-part JWT with alg=none and an empty signature is unsecured. This page can show its claims with an explicit warning, but it does not mark them valid or trusted. A nonempty signature with alg=none is rejected as inconsistent.
Are my JWT and claims uploaded or saved?
No. Decoding, copy and JSON export run locally after the page assets load. This token-entry route disables third-party ads and analytics. The raw token and signature bytes are omitted from copies and the downloaded report. Avoid pasting a live bearer credential when possible; Clear removes visible state but cannot promise secure erasure from browser memory.