Decode compact JWT header and payload JSON locally. Inspect unverified timing claims and download a decoded report. This tool does not verify signatures or establish token trust.
No clock-skew allowance is applied. Times are snapshots from your device clock; decode again to refresh. UTC display uses millisecond precision. Timing results do not establish token validity.
| Claim | Original value | UTC | Clock comparison only |
|---|
Decoding happens entirely in your browser, with no token uploads, external key lookup, account, dependencies or saved input history. Claims and URLs are displayed as plain text and never executed or followed. Reports retain the unverified notice so decoding is not confused with authentication.
No. It decodes readable segments and inspects the claims as provided. No signature, MAC, key, issuer, audience, critical-header semantics or authorization policy is verified. Changing the payload can still produce a decodable token. Never use this result as proof that a token is genuine, trusted or usable. No signing or secret-key input is offered.
Three-part compact tokens with nonempty Base64URL-encoded JSON-object header and payload are supported. A surrounding whitespace trim and optional leading Bearer prefix are accepted. Segments must use canonical unpadded Base64URL; embedded whitespace, invalid unused bits, padded Base64 and malformed UTF-8 are rejected. Encrypted five-part JWE, detached payloads and b64=false payloads are not supported. Duplicate JSON keys anywhere in header or payload are rejected.
exp, nbf and iat are inspected only when supplied as JSON numbers. NumericDate uses seconds since the Unix epoch. An exp equal to or before the captured device time is described as expired according to that claim; nbf after that time is described as not-before in the future. iat is simply compared with the clock. Missing or wrongly typed claims are labeled. No overall validity verdict is produced, and missing exp does not imply unlimited validity.
The comparison is a snapshot taken when Decode is clicked, using your device clock and zero leeway. UTC dates display millisecond precision; fractional JSON numbers are converted to browser numeric values for timing comparisons only, while original JSON number spellings remain in the output. Non-finite or out-of-range dates are labeled unavailable. Decode again to refresh. Correct time comparisons still do not verify the token.
The decoder displays explicit notices. alg=none declares an unsecured token, and an empty signature is identified separately. Neither is treated as authentication. The example uses alg=none with an empty signature and demonstration claims, rather than a real credential. The algorithm summary may be shortened after 80 text units; full header JSON remains available.
The input limit is 64,000 UTF-16 units before trimming. The shared JSON checker also limits decoded structures to 50,000 tokens and 100 nested containers. Errors expose no partial exports. Input edits and Clear remove old results; Clear empties the token. Nothing is uploaded or saved. Reports contain decoded claims and should be treated as private data. Only the site’s theme preference is stored.
