Inspect an untrusted JWT safely
- Paste a three-segment header.payload.signature value.
- Review decoded JSON as untrusted data.
- Use date interpretations only as context from this device's clock.
JWT Decoder and Claim Inspector
Decode a three-part JWT header and payload locally without verifying or trusting its signature or claims.
Decoded does not mean verified or trusted.No signature, issuer, or claim authenticity is checked.
Input and results stay in browser memory in this tab. Nothing is uploaded, logged, saved, or added to the URL.
Enter text and choose an action.
Inspect the JSON header, payload, signature-segment presence, and common claims in a three-part JWT/JWS. Decoding only reveals text; it does not verify the signature, issuer, audience, or claim truth.
How OpenFileTools processes it
Local processing, explicit choices.
Base64URL header and payload segments are strictly decoded as UTF-8 JSON objects in memory. Nothing is fetched from an issuer and payload content is never executed.
Questions, answered.
Is a decoded JWT valid?
Not necessarily. Authenticity, signature, issuer, and audience are not verified.
Why can an expired-looking token still decode?
Decoding reads claims only. An exp timestamp in the past is informative and does not establish overall token validity.