JWT decode / inspect
Base64URL-decodes and JSON-parses the header and payload of a three-segment JWT and renders iat/exp/nbf as UTC. **Decode only — signature is NOT verified**, never marked signature-valid; damaged or non-JSON segments are recorded explicitly.
Inputs and parameters
input— JWT token (header.payload.signature)
Real example
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZW1vLXVzZXIiLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MTcwMDAwMzYwMCwic2NvcGUiOiJyZWFkOmRlbW8ifQ.ZGVtby1zaWduYXR1cmUtbm90LXZlcmlmaWVk
→ header={"alg":"HS256"}, payload={"sub":"demo-user","iat":1700000000,...}; signatureVerification="NOT_PERFORMED", signatureVerified=false, notice="解码不验证签名 / Decode only — signature is NOT verified"Limits and failure handling
**No signature verification at all**: no keys, no HMAC/RSA check, no iss/aud validation, no expiry or trust judgement. Requires exactly 3 segments; no JWE, no decryption, no token generation. Input cap 64 KiB (smaller than the 1 MiB default). JWT content never enters analytics, URLs or error logs.
FAQ
Does the result say "verified"?
Never. signatureVerified is always false, signatureVerification is always NOT_PERFORMED, and both UI and docs state "decode only — signature is NOT verified".
What if the payload is not JSON?
An error is recorded and the raw text is shown verbatim as __rawText / __notJson; no payload is fabricated and no authentication success is claimed.
Is the token stored or reported?
No. It is not persisted and never enters analytics or logs; the signature segment in the example is a demo string, not a real key.