ConverterJWT Decode
Inspect compact token structure without pretending to verify it. Three-part JWS content can be read; five-part JWE ciphertext cannot be shown as plaintext without keys and authenticated decryption.
Inspect A Compact JWT, JWS, Or JWE
Compact Structure Classification
| Parts | Classification | What this page exposes |
|---|---|---|
| 3 | JWS compact serialization | Protected header and payload JSON; signature not verified |
| 5 | JWE compact serialization | Protected header and encrypted-part notice; no plaintext |
| 2, 4, or other | Unsupported/malformed | Error |
Decode Is Not Verify
The tool uses strict base64url and UTF-8 decoding, validates JSON object roots, and displays the decoded JSON text without reserializing numeric lexemes. Readable output does not establish signature validity, accepted algorithms, issuer, audience, time validity, revocation, or authorization.
exp, nbf, and iat may be displayed as UTC timestamps for convenience when their parsed values fit the display model. The original payload text remains visible, and a timestamp display is not a clock-policy decision or validity status.
Trust Boundary
- Verify signatures with trusted keys and an allowlisted algorithm in the receiving application.
- Validate issuer, audience, time claims, and authorization policy server-side.
- Avoid pasting production bearer tokens into tickets, screenshots, logs, or untrusted tools.
Questions About This Tool
No. It decodes visible compact parts for inspection and never marks the token valid or authentic.
Five-part JWE compact serialization contains encrypted content. Plaintext requires decryption keys and authenticated decryption.
No. It only renders an unverified numeric claim; validity also depends on signature, clock policy, issuer, audience, and application rules.