What JWT Decoder does

The decoder separates a three-segment JWT, converts Base64URL header and payload data to UTF-8 JSON and displays common time claims. Decoding is not signature verification.

How to use it

• Paste a JWT directly into the field.
• Choose Decode token.
• Inspect header, payload, segment lengths and local-clock status.
• Copy individual JSON sections or download the report.

Practical example

The built-in demonstration token contains algorithm, type, issuer, subject, issued-at and expiration claims.

Technical methodology

Segments are padding-normalized, decoded as bytes, converted through TextDecoder and parsed as JSON. exp and nbf are compared only with the current device clock.

Common uses

• Inspect development tokens
• Read standard claims
• Convert Unix dates
• Troubleshoot token structure

Common errors

• Not exactly three segments
• Invalid Base64URL characters
• Non-JSON header or payload
• Token above 100,000 characters

Security and privacy

Tokens never leave the tab, enter URLs or analytics. The decoder does not fetch JWKS endpoints and never executes claim content.

Limitations

The signature is displayed but not verified. A decoded token may be forged, expired, revoked or inappropriate for the intended audience.