JWT Decoder
Read the header and payload of a JSON Web Token, with iat / nbf / exp as dates and an expiry check. The signature is not verified.
Every Base64 flavour
Standard, URL-safe, without padding, MIME 76-character lines, data URIs and one value per line.
Thai charsets done right
UTF-8, TIS-620, Windows-874, UTF-16 and 20 more character sets for text that must match legacy systems.
Exact error position
Strict validation tells you the line, column and character that breaks the Base64 – one click jumps there.
Private by design
Everything runs in your browser (20 documents kept on this device). Nothing is uploaded until you share a link.
How to use
- Paste the token (eyJ…).
- Read the claims; expired tokens are flagged.
- The result appears instantly in live mode – or press Ctrl+Enter.
- Copy, download with the right file extension or share a read-only link.
Frequently asked questions
What is Base64?
Base64 writes any bytes with 64 safe characters (A–Z, a–z, 0–9, + and /) so binary data can travel in e-mail, JSON, URLs and HTML. It is an encoding, not encryption.
Why does my Thai text decode as garbage?
The bytes were probably made with another character set. Switch the charset to TIS-620 or Windows-874 (older Thai systems) or UTF-8 (web and modern apps).
What is URL-safe Base64?
It replaces + with - and / with _ and usually drops the = padding, so the value can be used in URLs, file names and JWTs.
Is my data uploaded?
No. Encoding, decoding, previews and hashes run in your browser. Data is sent only when you press Share or save to your Library after signing in.
How big can a file be?
Files up to 100 MB are read in 3 MB chunks with a progress bar, so a 20 MB image stays responsive. Library limits depend on your plan.