Parse a JWT locally to inspect its segments and claims. Decoding alone does not verify signature, issuer, audience, expiry, authorization, or trust.
Choose your path
Strictly Base64URL- and UTF-8-decode the exact header and payload JSON text of one authorized compact JWT/JWS fixture while preserving a visible boundary that no signature, claim, time, authorization or trust validation occurred.
See exact decoded header/payload text without a secret verifier or generator distracting from parsing evidence.
Paste a non-production three-segment fixture, inspect strict errors/raw JSON and save the four-field Project record.
Can reproduce segment decoding without calling the claims valid.
Prevent alg, issuer, audience, subject, time and authorization claims from being trusted before application validation.
Exercise alg=none, malformed segments, wrong JSON types and time claims while retaining the unverified boundary.
No green validity badge, credential input or decoder-only authentication conclusion remains.
Avoid exposing live tokens and operate long encoded text/errors/results on keyboard and narrow screens.
Use authorized redacted fixtures, labeled controls, inert raw-text output and Project save; never paste a live credential.
Completes local inspection without secret collection, unnamed controls or horizontal page overflow.
Outputs and checklists are planning aids. Review the linked current authorities and the records, terms, instructions, and requirements that apply to your exact situation before a consequential decision.
This tool is part of these guided projects. Each project provides step-by-step instructions with checklists and all the tools you need in one place.
Tools you might need next
Test ECMAScript regular expressions with exact global, Unicode, capture, index, and replacement behavior plus conservative backtracking-risk refusal.
Strictly decode standard or URL-safe Base64 into UTF-8 text, with explicit malformed-input errors and an untrusted-output security boundary.
Generate RFC 9562 UUIDv4 or UUIDv7 values on demand, validate canonical UUID text, and document identifier—not credential—boundaries.
The Tool expects exactly three dot-separated segments, bounds the token length, rejects whitespace, validates the unpadded Base64URL alphabet and uses fatal UTF-8 decoding.
Header and payload must each decode to a JSON object. Exact decoded text remains visible; JSON.parse output and NumericDate rendering are convenience observations with explicit mutation and trust limits.
The page contains no secret input, signature verifier, URL token extractor, or JWT generator. Validation belongs in the exact application boundary with current protocol-library policy.
Updated: August 2026
Parse a non-production JWT test vector to review its segment structure, claim names, value types, and encoded signature without treating the claims as verified.
Use authorized fixtures around expiry, not-before, issued-at, clock-skew, and missing-claim boundaries, then reproduce the application's own validation separately.
A security reviewer tests alg=none, invalid Base64URL, malformed UTF-8, non-object JSON and time boundaries while confirming no claim is labeled valid.
Strictly decode the exact UTF-8 JSON text in an authorized non-production compact JWT/JWS fixture. No signature, key, algorithm, issuer, audience, time, authorization, or trust validation occurs here.