JWT Decoder

The JWT Decoder splits a JSON Web Token into its dot-separated segments and shows you exactly what is there: which segments decoded, which did not, and why. The header and payload are decoded with a real base64url decoder — the URL-safe alphabet, no = padding, and a character outside the alphabet is named with its position instead of being quietly dropped — then parsed as JSON. Anything that is not a signed compact token is refused with a reason instead of half-decoded.

Claims are listed with their real values. exp, nbf, iat and auth_time are NumericDate seconds, so each one is shown as an absolute UTC date and time and as a reading you can act on: expires in 2 hours, expired 3 days ago, not valid for another 30 minutes. Registered claims that are missing are listed as missing rather than implied. The header, the payload and the raw token each have their own copy button, and a payload that is a JSON array or a scalar is shown as what it is rather than treated as a broken object.

Decoded, not verified. This page has no key, no issuer and no way to check a signature, so it never tells you whether a token is authentic or whether a claim is true. It does not fetch a JWKS endpoint, and it makes no network request of any kind: the token is read in the tab and never leaves it. Treat every claim as untrusted data. Input is capped at 262,144 characters (256 KB) and anything larger is refused before a single byte is decoded.