Local JWT decoder
Split a compact JWT and read header + payload here. Decoding is not verification. The token never leaves this page.
Ready · no signature check · no key field
How it works
A JWT is three Base64URL parts. This page decodes the first two as JSON. It does not check the signature, does not accept a secret, and does not build a new token.
exp, nbf, and iat are shown as UTC ISO if they look like Unix seconds.
Examples
// payload fragment
{ "sub": "user-1", "iat": 1700000000, "exp": 1700003600 }
// iat → 2023-11-14T22:13:20.000Z
// exp → 2023-11-14T23:13:20.000Z
FAQ
Is a decoded token valid? Unknown. Validity needs signature verification on a server you trust. This page will not do that.
Why no secret box? Pasting a production secret into any webpage is a bad habit. Decode-only avoids that.
Is the token uploaded? No. There is no network call in this script.
What if there are only two parts? Encrypted JWE or a truncated string. The page reports that and stops.
UTF-8 names in the payload? Yes. Bytes are decoded as UTF-8 after Base64URL.