Local JWT decoder
Paste a JWT to read its header and claims as formatted JSON; the signature is not verified, so don’t use it as proof of trust.
- Runs in your browser
- No upload
- Result stays on your device
Privacy & limitsRuns in your browser. Nothing is uploaded.
Input content stays in this tab; Refentra does not upload or store it. Optional aggregate action counts are sent only with your usage consent. Clear the workspace when finished.
Supported profile: JWT header and claims only. Signature, issuer and audience are NOT verified.
Maximum text: 200,000 UTF-16 units; parser limits can be smaller. Worker time limit: 15 seconds (regex 1.5 seconds).
Check the input and the result
- Prepare and choose the operation
Paste a three-part JWT and inspect the header, payload and time claims. Don't treat the decoded data as trusted.
- Check a concrete example
Use this sample and compare the indicated result: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0In0.signature → header {"alg":"HS256"}, payload {"sub":"test"}
- Check the output before you reuse it
Read the exp and nbf observations against the current clock. Decoding a token never proves who issued it or what it allows.
Answers for this task
Is the signature verified?
No. The header and payload are only base64url-decoded. An attacker can fabricate both, even when the claims shown look plausible.
What should I check if the input fails?
If there is surrounding Bearer text, remove it. Keep the two dots, and check that the first two segments are valid base64url JSON.
Where does this tool stop?
This doesn't authenticate users, verify cryptographic keys, contact issuers or enforce audience and application policy.