JWT Decode

Decode a JWT by base64url-decoding its header and payload. Does NOT verify signatures — use jwt-validate for that.

Steps

1. Split the token on . into three parts (header, payload, signature).
2. Base64url-decode and parse parts 1 and 2 as JSON.
3. Display header, payload (with all claims), and the raw signature string.
4. For exp, nbf, iat — show both the Unix timestamp and human-readable UTC. If exp is past, note expired and by how long.
5. Run security checks (see below).

Output Format

## Header
{ "alg": "RS256", "typ": "JWT", "kid": "abc123" }