Does this verify the token's signature?

No — it only decodes the header and payload so you can read their contents. Verifying a signature requires the actual signing secret or public key, which this tool never asks for or has access to.

Is my token sent anywhere?

No — decoding happens entirely in your browser using standard JavaScript. Nothing you paste is transmitted or logged, which matters given that tokens often contain sensitive session data.

Why didn't my SAML assertion decode?

This tool handles plain base64-encoded SAML XML (the common HTTP-POST binding format). It doesn't support DEFLATE-compressed SAML used in some HTTP-Redirect binding flows — if your assertion doesn't start with "<" after decoding, that's likely why.

What do exp, iat, and nbf mean in a JWT?

They're standard timestamp claims: iat is when the token was issued, exp is when it expires, and nbf ("not before") is when it becomes valid. This tool converts any of these it finds into readable dates automatically.

SAML 2.0 / OAuth Payload Decoder & Visual Inspector

Q: What do exp, iat, and nbf mean in a JWT?

They're standard timestamp claims: iat is when the token was issued, exp is when it expires, and nbf ("not before") is when it becomes valid. This tool converts any of these it finds into readable dates automatically.

Developer

Paste a token or assertion, see exactly what's inside.

Paste a token or assertion

JWT or base64-encoded SAML XML — auto-detected.

JWT

Decoded

iat: Jan 13, 2025, 8:26 PM

exp: Jan 13, 2025, 9:26 PM

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "usr_8842",
  "name": "Jordan Lee",
  "iat": 1736800000,
  "exp": 1736803600
}

Signature (not verified)

dGhpc19pc19hX2Zha2Vfc2lnbmF0dXJl

About this tool

Paste a JWT or a base64-encoded SAML assertion and instantly get it decoded client-side into a clean, readable JSON or XML view — including human-readable timestamps for exp/iat claims — built for fast SSO troubleshooting.

How to use SAML 2.0 / OAuth Payload Decoder & Visual Inspector

1
Paste a JWT (three dot-separated segments) or a base64-encoded SAML assertion — the type is detected automatically.
2
For JWTs, review the decoded header and payload, plus human-readable expiry and issued-at times.
3
For SAML, review the pretty-printed XML structure.
4
Copy whichever part you need for your troubleshooting or documentation.

Frequently asked questions

Related tools

JSON Tree Formatter & Syntax Validator

Turn messy or broken JSON into a clean, color-coded tree.

Developer

WCAG Typography Readability Checker

Check if your text and background actually pass accessibility standards.

Developer

CSS Grid & Flexbox Live Layout Playground

Adjust sliders, watch the layout update, copy the CSS.

Developer