You can also load data via #data={"name":"Ada"} or #url=... It is cleared from the address bar after it is read.
A JWT has Header, Payload, and signature. This page only Base64URL-decodes the first two segments in the browser so you can inspect expiry and custom claims. The token is never sent to a server. When debugging a login session or checking whether exp has expired, you do not need to paste a real token onto an unknown site.
Useful for debugging a login session and checking exp / sub . The Header shows algorithm and type; the Payload holds business claims.
If the signature segment is missing, the first two segments are still decoded so incomplete logs remain usable.
Private keys should not appear in a web page. Production verification belongs on the backend. Anyone with the token can read the Payload; confidentiality depends on HTTPS and short expiry.
This page shows the signature string but does not verify HMAC / RSA.
Recognizes iss、aud、iat and other registered fields and labels their meaning. Numeric timestamps are converted to readable time when possible.
Custom claims are listed as-is so you can compare them with your login protocol.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IuW8oOS4iSIsImlhdCI6MTcyMDAwMDAwMCwiZXhwIjoxOTAwMDAwMDAwfQ.signature{
"header": { "alg": "HS256", "typ": "JWT" },
"payload": { "sub": "1234", "name": "张三", "iat": 1720000000, "exp": 1900000000 }
}Currently only the signature string is shown. Authenticity is not verified. Anyone can decode the Payload; confidentiality depends on HTTPS and backend verification.
JavaScript Number has a precision limit. For very large IDs, compare the raw Payload. Do not rely only on the converted number.
It is not uploaded and not written to cloud history. Close the tab and it disappears from memory.
No, and it should not. Without the private key you cannot produce a token the server will verify. This page is read-only.
exp / nbf matches the current time, and whether aud points at the right service. A JWT that can be decoded is not the same as authenticated. Treat the token like a password and expire it promptly.