Before you start
What you need
One compact JWT containing readable JSON header and payload sections.
Developer & Data
JWT Decoder
Read a JWT header and payload locally with an explicit signature-not-verified warning.
- 01Runs in this browser
- 02Limits are explicit
- 03Copy or download output
No black box
How this tool handles the input
The first two Base64URL sections are decoded as strict UTF-8 JSON. The signature section is not checked and no issuer keys are requested.
What you get
What the page gives back
Formatted header and payload claims marked signature_verified: false.
Keep in mind
Use the result responsibly
Decoded claims are untrusted until a server verifies algorithm, signature, issuer, audience, time claims, and authorization policy.
Practical uses
Where this tool earns its place
- Inspect claim names in a test token.
- Check whether a service emits expected audience data.
- Read algorithm metadata before server-side verification.
Verified data boundary
Source text stays on this page.
The published contract marks these tools as client-only processing. Nirmion uses the API only to confirm that this workspace is enabled in MySQL; source values and results are not sent to Flask.