JWT Decoder and Claims Inspector
Decode JWT header and payload, inspect claims and expiry, and view diagnostics without verifying signatures.
Decoded locally in your browser. Signature is not verified.
Decoded JWT
How to use
Read the header, payload, registered-claim timeline, and segment diagnostics from a three-part JSON Web Token without confusing decoding with validation.
- 1Paste a three-part header.payload.signature JWT or load the built-in sample.
- 2Decode the token and review format errors or expiry, not-yet-valid, and empty-signature warnings.
- 3Inspect alg, typ, kid, segment sizes, header, payload, and the exp, iat, and nbf timeline.
- 4Copy only the section you need, then reset the page so a sensitive token is no longer visible.
Technical background
The decoder parses the first two dot-separated Base64URL segments as JSON objects. It displays alg, typ, kid, byte sizes, and exp, iat, and nbf times, but it has no verification key and cannot prove the signature or issuer.
Use cases
Inspect token shape during development, read scopes and audiences, convert expiry values to ISO UTC, and diagnose malformed or not-yet-valid tokens.
Privacy and security
A live JWT can be a bearer credential. Decoding runs in the current browser, but you should still avoid pasting production tokens on shared devices or exposing copied payloads.