JWT decoder
Inspect a compact JWT header, payload, signature and dates locally, without verifying its signature.
Signature not verified
Principle and example
A compact JWS has three dot-separated Base64URL segments: header, payload and signature. This tool decodes the first two as JSON objects, preserves original number tokens, and displays signature bytes; it does not authenticate any claim. For example, eyJhbGciOiJub25lIn0.eyJleHAiOjB9. has alg none, exp 0 and an empty signature. exp 0 is 1970-01-01T00:00:00.000Z. exp is expiration, iat issuance and nbf earliest use, all Unix seconds. UTC and browser-local dates are informational, at millisecond precision; raw numbers are retained. Duplicate dates, nonnumbers and out-of-range values are flagged. No valid/safe decision is made from dates or alg. Five-part encrypted JWE is unsupported.
Limits and privacy
Text limit: 1 MiB of decoded UTF-8 (up to 1,398,104 encoded ASCII characters). JWT limit: 100 KiB, JSON depth up to 200. Text only: no files or data URIs. Inputs and outputs remain in page memory, never URL parameters, storage, logs or analytics. No keys, signing, JWKS requests or signature verification. Changing input clears the previous result. Clear removes page state; copying writes only the chosen result to your clipboard, whose history is managed by your device. Reloading clears the tool; browser extensions and your device remain outside its control.