JWT Decoder

A JWT is three Base64url segments joined by dots — header, payload, signature. The first two are just encoded JSON, so reading them needs no key at all, which is exactly the point of this tool and exactly why a JWT should never be treated as confidential. Anyone holding the token, or anyone it merely passes through, can read every claim inside it.

The signature is the part that actually proves anything, and verifying it requires the algorithm and secret (or public key) the issuer signed with — something a page running in your browser has no way to obtain, and should not be trusted with even if it could. This decodes; it does not and cannot tell you whether the token is genuine.

Where this saves real time is the payload's registered claims. exp, iat and nbf are Unix timestamps, unreadable at a glance, and this converts them to a date and a plain relative description — 'expired 2 hours ago' is immediately useful in a way that 1700003600 is not.

Verifying a JWT means recomputing its signature with the same algorithm and key the issuer used, then comparing the result byte for byte. For an HMAC-signed token that key is a shared secret; for an RSA- or ECDSA-signed one it is at least the issuer's public key. A tool running entirely in the visitor's browser has neither, and a tool that asked for the secret to 'verify' a token would be asking you to hand over the one thing that must never leave your server.

Verification belongs in the backend that issued the token, using a proper JWT library and the actual signing key. What this page tells you — whether the token is well-formed, what it claims, and whether it has expired — is useful for debugging, but it is not proof of authenticity.