JWT Decoder — Read a JSON Web Token

A JWT is three Base64url segments joined by dots: header, payload, signature. Decoding the first two is nothing more than a Base64url decode followed by a JSON parse — no key is involved at any point. That is worth sitting with, because it is the property people most often get wrong about tokens: a JWT payload is encoded, not encrypted. Anyone who holds the token can read every claim in it, including this page, including any proxy it passed through, and including whoever finds it in a log file.

What this tool does not do is verify the signature, and that omission is deliberate rather than unfinished. Verification requires the issuer's HMAC secret or public key, and a web page that asks you to paste your signing secret is asking for the credential that mints tokens for your entire system. So there is no "valid" badge anywhere on this page. The status shown is derived purely from the token's own exp and nbf claims measured against your clock, which is arithmetic on data the token already gave away.

The registered time claims — iat, nbf and exp — are defined by RFC 7519 as NumericDate: a count of seconds since 1 January 1970. JavaScript's Date.now() returns milliseconds, so a token built by hand is very often a thousand times off, which puts its expiry somewhere in the year 56000 and means it effectively never expires. Any claim here whose magnitude looks like milliseconds is flagged rather than silently rendered as a far-future date.