JWT decoder and claims inspector

Decoding is not signature verification

A JWT header and payload are Base64url-encoded, not encrypted. This tool decodes those two segments and reports the signature segment’s byte length, but it does not possess a trusted key, fetch a JWKS document, choose an allowed algorithm, or verify the signature. Any person can create a token whose decoded claims look legitimate.

Registered time claims use NumericDate seconds

The inspector translates finite integer exp, nbf, and iat values from Unix seconds to UTC ISO timestamps. It also compares expiration and not-before claims with the browser clock. Production validation normally needs an explicit clock-skew policy, maximum token age, issuer rules, audience rules, and replay controls.

Structure warnings are useful but incomplete

The result calls out an absent algorithm, the unsecured none algorithm, unexpected token type, missing or empty signature data, malformed JSON, invalid UTF-8, and incorrectly typed time claims. These checks help with debugging; passing them is not a security decision.

Claims require application-specific validation

Servers should verify an allowed signature algorithm and trusted key before using claims, then validate issuer (iss), audience (aud), subject, expiration, not-before time, token purpose, and any required application fields. Algorithm selection must come from trusted configuration rather than an untrusted header alone.

Privacy and bearer-token risk

Decoding runs in this browser tab and Gypes does not intentionally upload the token. A live bearer token can grant account access, however, and browser extensions, clipboard managers, screenshots, shared devices, or injected scripts can expose it. Prefer a redacted or expired token and revoke any credential pasted into an environment you do not fully trust.

Never authorize a request because this page decoded a token successfully. Verify the signature and every required claim in the receiving system with a maintained JWT library, fixed algorithm policy, trusted keys, and appropriate key-rotation handling.