JWT decoder

Browser only

Inspect a compact JSON Web Token without uploading it. Decoding reveals claims; it never proves the signature or that the token is trustworthy.

Up to 32,768 characters. The decoder makes no request, uses no cache or storage, and never adds the token to the URL. Press Ctrl+Enter to decode.

No token decodedPaste a three-segment compact JWT above. The value stays in this browser tab and is cleared when you choose Clear or leave the page.

Decoding is not verification

A JWT header and payload are base64url-encoded, not encrypted. Anyone can create or change those segments. This tool validates the compact shape, base64url alphabet, UTF-8, and JSON structure, then displays common registered claims such as issuer (iss), audience (aud), expiration (exp), and not-before time (nbf).

The algorithm is only a claim from the untrusted header. IP Yellow does not use a secret or public key, select a trusted algorithm, validate the signature, check revocation, enforce issuer or audience policy, or grant access. NumericDate status uses your browser clock without application-specific clock skew.