Inspect a token without treating it as verified
A signed compact JWT normally contains a Base64url header, a Base64url claims object and a signature, separated by dots. This tool decodes those segments and checks their encoding and JSON structure. It does not verify the signature, enforce an algorithm allowlist, authenticate the issuer, check the intended audience or make an authorization decision.
Header URLs such as jku or x5u are shown as text and never fetched. No signing secret, private key or JWKS endpoint is needed. An alg:none example is deliberately unsigned. An empty or malformed signature is identified without implying that another signature has been verified.
Read expiration and other time claims carefully
exp, nbf and iat are NumericDate values: JSON numbers of seconds since the Unix epoch. The tool shows UTC dates and compares them against your device clock at the displayed check time. Refresh when needed. It applies no clock-skew allowance or server policy, and it never labels a token valid merely because a claimed expiration is in the future.
Fractional values are compared using exact decimal arithmetic. The displayed date stops at milliseconds; more precise original values remain in the JSON. Unsupported date ranges, wrong types and duplicate time claims get explanatory messages instead of guessed dates. Missing exp does not imply permission to use a token indefinitely.
Preserve the JSON you are inspecting
Large integer literals, original string escapes, property order and duplicate properties are retained in copy/download output. Duplicate names are flagged because consumers can interpret them differently. JSON is displayed as text, never rendered as markup. Large previews stop at 32,768 characters, while Copy and Download include the complete decoded JSON.
The inspection report stores complete header and payload JSON as strings to avoid silently rounding numbers. Separate header and payload downloads are ordinary JSON documents. Reports omit the original compact token and raw signature but still contain decoded claims, which may be personal or confidential.
Supported input and recovery
Surrounding whitespace and an optional Bearer prefix are removed with a notice. Internal whitespace, = padding, the standard Base64 +/ alphabet, malformed UTF-8 and non-canonical unused bits are rejected. Five-part encrypted JWE, detached payloads and b64:false JWS are outside this decoder’s scope.
Example, file import and large paste keep one previous input and its source filename for Undo; ordinary typing clears that history. Clear & forget discards the current input, decoded views and that replacement history, so it cannot be undone. File reading and decoding each have a ten-second deadline and can be cancelled. No token is uploaded or saved automatically.
References: JWT, RFC 7519, JWS, RFC 7515, and JWT best current practices, RFC 8725. For standalone encoded text, use the Base64 decoder.