Decodificador JWT
Decodifica un JSON Web Token para inspeccionar su encabezado y sus claims. Decodificar no es verificar: la firma no se comprueba.
This tool only decodes the Base64URL-encoded parts of the token. The signature is NOT verified, so the contents shown here must not be trusted on their own. Anyone can create a token with arbitrary contents; only a verified signature proves authenticity. The token is processed locally and never stored or sent anywhere.
Cómo usar
Paste a JWT and press Decode. The header and payload are shown as JSON, and the exp, iat and nbf claims are displayed both as raw Unix timestamps and as ISO 8601 times. An exp in the past is flagged as expired. The signature is only displayed as text.
Notas
Most important: decoding is not verification. This tool never checks the signature. Anyone can forge a JWT with arbitrary contents, so never treat what is shown here as trusted. Your token is processed only in your browser and is never stored or sent anywhere — but still handle live production tokens with the same care as any other secret.
Preguntas frecuentes
Can this verify the signature?
No. Verification needs the issuer's key and belongs in a server-side library. This tool only decodes.
Is the payload encrypted?
No. A standard JWT (JWS) payload is only Base64URL-encoded and readable by anyone. Never put secrets in it.