About JWT Decoder
A small, single-purpose page for reading what is inside a JSON Web Token, without sending that token to anyone.
What this tool does
Paste a JWT and it is split on its two dots into header, payload and signature. The header and payload segments are base64url-decoded and parsed as JSON, then rendered as pretty-printed, colour-coded text. The exp and nbf claims, if present, are compared against your device's current time to show whether the token is expired, not yet valid, or currently valid. That is the entire feature set: decode, format, and check the two timestamp claims that determine a validity window.
What it deliberately does not do
- It does not verify the signature. That needs the issuer's secret or public key, which this page has no way to obtain and does not ask for. The signature segment is shown exactly as received and nothing more.
- It does not send the token anywhere. There is no server-side component to this tool. The base64url decoding, JSON parsing and expiry comparison are plain JavaScript running in your browser tab.
- It does not store anything. Nothing is written to a database, a log, or browser storage. Reload the page and the token is gone.
- It does not decrypt a JWE. A five-segment token is encrypted, not merely encoded, and there is no decoding step that reveals its contents without the recipient's private key — this tool reports that as a segment-count error rather than guessing.
Why decoding client-side matters here specifically
Plenty of tool categories are fine to run server-side. A JWT is a bad candidate for that, because a real one usually contains something identifying — a user ID, an email, a session reference, sometimes role or permission data. A "paste your JWT here" tool that processes it on a server is, functionally, a place you send a piece of someone's session to a third party. Keeping the decode entirely client-side removes that step rather than just promising not to misuse it.
How the base64url decoder is built
Rather than relying on the browser's atob (which decodes standard base64, not the URL-safe variant JWTs use, and mishandles missing padding) this tool implements the base64url alphabet and bit-packing directly: each character maps to 6 bits, they are packed into bytes, and the URL-safe substitutions (- for +, _ for /) are undone before that. The resulting bytes are then run through a strict UTF-8 decode (TextDecoder in fatal mode), so a claim value containing accented letters, CJK characters or an emoji decodes correctly instead of coming out as mojibake or silently truncating.
The decoding logic has no dependency on the DOM at all — it is a single file that can run under Node with no browser present — and is covered by an automated test suite checking a known sample token, UTF-8 payloads, expired/valid/not-yet-valid timing, and several ways a token can be malformed (wrong segment count, invalid base64url, non-JSON content). See the decoder for the tool itself.
How it is funded
The site is free to use. It may carry advertising later to cover hosting costs; see the privacy policy for what that currently means and what would change.