The JWT Decoder decodes the header and payload segments of a JSON Web Token locally. It also exposes the signature text, original encoded segments, and expiration status when the payload contains a numeric exp claim.
JWT structure
A compact JWT has three dot-separated base64url segments:
header.payload.signature
The decoder normalizes base64url characters, parses the first two segments as JSON, and compares exp with the current time. It does not verify the signature.
Questions
Does decoding prove a JWT is valid?
No. Anyone can decode a JWT. Signature verification requires the issuer's algorithm, key, and validation rules.
What does an expired status mean?
It means the numeric exp timestamp is at or before the comparison time. A token without exp is reported as having no expiry claim.
Is my token sent to a server?
The calculation module decodes in the browser. Avoid pasting live secrets into shared environments regardless of local processing.
Security limitation
Never treat decoded claims as trusted authorization data until the token signature, issuer, audience, timing, and algorithm have been verified by the consuming service.