JWT Decoder

A JWT is three Base64URL segments separated by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two. Decoding the first two is arithmetic anyone can do — which is the single most important thing to understand about the format. A JWT is not encrypted. Everything in the payload is readable by anyone holding the token, so nothing secret belongs in one.

Decoding is also not verification. Only a party holding the issuer's signing key can establish that a token is genuine and unmodified. This page never asks for that key and never checks the signature; the third segment is shown verbatim and left alone. Treat every value here as what the token claims, not as fact.

The checks it does run

Structural things that can be judged from the token alone: an alg of none, an empty signature, a missing or already-past exp, an nbf still in the future, a lifetime longer than a day, and an absent aud. Each is reported with its reason rather than a bare score.

Unicode

Segments are decoded to bytes and then read as UTF-8 in strict mode. A payload containing non-ASCII names decodes correctly; a segment that is not valid UTF-8 is reported as an error rather than silently rendered as replacement characters that would look like a successful decode.

A token whose header is {"alg":"none","typ":"JWT"} decodes fine and is flagged immediately: it carries no signature at all, so any server that accepts it is trusting whatever the payload says. That is the classic JWT implementation flaw, and it is visible from the decoded header alone.