Security

Base64url split only. Signature check stays on your server.

Paste a three-segment JWS (header.payload.signature). We decode the first two as JSON and show iat / nbf / exp when they are Unix seconds. We do not verify the signature. Five-segment JWE is rejected. Treat every claim as untrusted until your API proves it.

Not verified. This page only decodes Base64url — it does not check cryptographic signatures. Anyone can forge claims if you skip server-side validation.

Leading Bearer is stripped. JWS tokens use three segments (JWE uses five — not supported here).

When to use this — and when not to

Use it to inspect a three-segment JWS you already have: see alg, kid, iss, aud, and time claims as UTC. Optional Bearer prefix is stripped. Nested JWT strings in claims stay strings — paste them again if you need a second pass.

Do not treat a decoded payload as authenticated. We never verify the signature. We never fetch JWKS. Five-segment JWE is rejected. Do not paste live production access tokens into a shared screen or ticket.

What the decoder actually does

Split on .. Base64url-decode segments 0 and 1, JSON.parse, pretty-print. Numeric iat / nbf / exp / auth_time become ISO timestamps. Segment 2 is shown as text plus decoded byte length. That is the whole pipeline. The token stays in this tab.

Worked example

A typical header you will see:

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "2024-11"
}

If alg is none, your server still has to reject it. This page will happily show the JSON. Verify with your IdP library, not here.

Mistakes people make

  • Shipping a “the decoder showed exp in the future” check as auth. Anyone can mint that JSON.
  • Pasting a JWE and expecting decrypt. Five segments ≠ three.
  • Leaving a session token in the field on a shared laptop.

Related

HTTP request builder (Authorization header as text) · CORS headers · About

Frequently asked questions

Does this verify the signature?

No. Decode only. Verification needs the issuer’s keys on a trusted backend.

Is the token uploaded?

No. Parsing is in this tab. Clipboard managers on the machine are still your problem.

Why won’t a five-part token decode?

That is usually JWE. Out of scope here.

How are exp / iat read?

Numeric Unix seconds in UTC. Strings skip the timeline — read the raw JSON.