JWT Decoder & Structure Verifier

A JSON Web Token (JWT) is a compact, URL-safe token made of three base64url-encoded segments — header, payload, and signature — separated by dots. This tool decodes the first two segments in your browser, formats them as readable JSON, checks time-based claims, and surfaces common security issues. Because tokens frequently carry session and identity data, nothing is ever sent to a server.

How it works

A JWT looks like header.payload.signature. The tool:

1. Splits the token on . and confirms there are three segments.
2. Base64url-decodes the header and payload (converting -/_ back to +// and restoring padding), then JSON.parses each.
3. Reads time claims: exp (expiry) and nbf (not before), both Unix seconds, and compares them to the current time.
4. Runs security heuristics: alg: none (unsigned), suspiciously short tokens, and missing iss or aud claims.

The signature segment is shown verbatim but never validated, because real verification needs the signing key — which should never be pasted into any web page.

Tips and notes

• A decoded payload is readable by anyone who has the token, so never put secrets in JWT claims; treat the whole token as sensitive.
• Always verify the signature server-side with the expected algorithm allow-list. Reject none and reject unexpected algorithms even if they decode cleanly.
• An expired token here may still be accepted elsewhere if a server has clock skew tolerance; the exp check is informational.
• Short-lived access tokens plus refresh tokens are safer than long expiries — if you see an exp far in the future, that is a smell worth flagging.