JWT decoder
Browser onlyInspect a compact JSON Web Token without uploading it. Decoding reveals claims; it never proves the signature or that the token is trustworthy.
Up to 32,768 characters. The decoder makes no request, uses no cache or storage, and never adds the token to the URL. Press Ctrl+Enter to decode.
Header
Payload
Common claims
No standard issuer, subject, audience, time, or token-ID claims were found.
Trust and timing notes
Decoding is not verification
A JWT header and payload are base64url-encoded, not encrypted. Anyone can create or change those segments. This tool validates the compact shape, base64url alphabet, UTF-8, and JSON structure, then displays common registered claims such as issuer (iss), audience (aud), expiration (exp), and not-before time (nbf).
The algorithm is only a claim from the untrusted header. IP Yellow does not use a secret or public key, select a trusted algorithm, validate the signature, check revocation, enforce issuer or audience policy, or grant access. NumericDate status uses your browser clock without application-specific clock skew.