JWT Decoder
Decode JWT header and payload segments locally and display expiry-related claims without implying signature verification. A readable token can still be forged or invalid.
Browser-localFreeNo upload required
What this tool is for
Decode JWT header and payload segments locally and display expiry-related claims without implying signature verification. A readable token can still be forged or invalid.
How to use
- Paste a token only if it is safe to expose on the current device.
- Decode the header and payload.
- Treat claims as untrusted until the signature, issuer, audience, and time rules are verified by the receiving system.
Example
Decode a sample token containing `exp` and inspect its UTC time while keeping the signature status explicitly unverified.
FAQ
Does decoded mean valid?
No. Decoding reveals claims but does not authenticate them.
Should I paste a production access token?
No. Use a non-sensitive sample whenever possible.
Reproducible examples
Known inputs and expected results
Run these examples in the workspace above and compare the result with the documented output.
Read header and payload
- Input
- eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxMjMiLCJuYW1lIjoiQWRhIn0.x
- Options
- Decode only; do not verify.
- Action
- Read the two
JSONsegments. - Expected output
- Header alg=none and typ=JWT; payload sub=123 and name=Ada; signature remains unverified.
- Explanation
- Readable claims are not authenticated claims.
Inspect a time claim
- Input
- A three-segment sample containing {"exp":1893456000}
- Options
- Decode the payload and show the
UTCinterpretation. - Action
- Inspect exp without trusting it.
- Expected output
- The numeric exp is displayed with its corresponding
UTCtime and an unverified warning. - Explanation
- Time display helps debugging but cannot prove issuer, audience, signature, or acceptance.
Error or unsupported case
Malformed Base64URL segment
- Input
- abc.@@@.sig
- Expected error or limit
- The payload cannot be decoded into valid
JSON. - Safer alternative
- Use a non-sensitive, complete JWT sample; verify real tokens in the receiving application with trusted keys.
When not to use this tool
- Signature, issuer, audience, nonce, or authorization verification
- Pasting production access tokens or confidential claims
Algorithm and assumptions
The tool expects three dot-separated segments, normalizes Base64URL for header/payload JSON decoding, and never validates the signature or trust chain.
Input and output
Input is a three-segment JWT string. Output is decoded JSON claims and timing observations; no cryptographic verification occurs.
Supported formats and behavior
- Base64url header and payload
JSONclaim display- exp, nbf, and iat time hints
Limits
- No signature or key verification
- Encrypted JWE tokens are not decoded
Edge cases and common errors
- Tokens may contain personal or authorization data
- Missing padding is normalized
- Very large timestamps can be invalid
Release testing
Checks cover a known token, malformed segments, invalid JSON, expiration display, no-verification warning, clear, and mobile use.
Privacy boundary
The input and result stay in this browser session. ZZP Box does not upload or store the values entered in this tool.
Related reviewed tools
Choose the next tool by the operation you need, then review that page's stated input and limits.