Inspect a JWT header and payload without verifying its signature.
Paste a three-part JWT (Header.Payload.Signature) and decode its header and payload. The example is fictional, unsigned data, not a working login credential.
The header may contain alg; the payload may contain sub and exp. All fields remain unverified input.
This only decodes Base64URL and JSON. It does not verify signatures, permissions or expiration and makes no network requests. Five-part encrypted JWE is unsupported. Numbers follow JavaScript JSON parsing rules.
Why can an expired JWT be decoded? Decoding reads the content. Expiration checks and signature verification are separate validation steps; decoding success is not validation success.