JWT Decoder (no signature verification)

Features

• Splits and formats the header, payload and signature
• Converts iat, nbf and exp into ISO timestamps and reports whether the token has expired
• Accepts unpadded Base64URL, a Bearer prefix and line-wrapped tokens
• Output is a single JSON document whose fields can be copied straight out
• Explains a wrong segment count, and reports a 5-part token as encrypted JWE rather than a JWT
• No signature verification, stated in the output itself — most online decoders never mention it

How to use

1. Paste the token, with or without a Bearer prefix
2. Press Ctrl/⌘ + Enter, or click Run
3. Read the three segments and the timestamp block, and check whether exp has passed
4. Click Copy to take the result — but never read it as proof that the token is valid

FAQ

It decoded successfully, so the token is valid, right?

No. This tool does not verify signatures, so it cannot tell whether a token was tampered with or who issued it. Anyone can construct a syntactically valid JWT with any payload at all, and it will decode here just as happily. Validity has to be established on the server by checking the signature with a secret (HS256) or a public key (RS256). A public key in the browser can only verify asymmetric signatures; an HS256 secret must never be shipped to a client.

Is the payload encrypted?

No. Base64URL is an encoding, not encryption, so anyone holding the token can read everything inside it — which is precisely what this tool does. Never put passwords, phone numbers or identity numbers in a JWT payload. If you need confidentiality, use JWE, which produces a 5-part token this tool cannot read.

Why does the output say signatureVerification: not-performed?

Because verifying a signature requires a key, and that key does not belong in a browser. All the tool can honestly do is say that it did not verify — rather than letting you assume "it decoded, therefore it was checked". That line does not change to performed for any token you paste.

Whose clock decides whether it expired?

Yours. The expiry flag compares exp against your machine time, so a wrong system clock gives a wrong answer. The authoritative expiry check always belongs on the server, since a client clock can be set to anything.

Why will my token not decode?

Usually a few characters were lost when copying — tokens are long and easy to truncate. The next most common cause is a 5-part JWE token, which is encrypted rather than merely signed. Note also that JWTs use Base64URL (- and _ instead of + and /, with no = padding), which this tool already handles.