JWS and JWT decoder
Paste a JWT or JWS in compact form and see the header, payload, times and the length of the signature, locally in the browser.
How it works
A JWS in compact form consists of three parts separated by dots: header, payload and signature, each Base64url-encoded. The decoder splits the parts, turns header and payload into readable JSON and shows times such as iat, nbf and exp as date and time.
In KYA, you meet JWS mainly as decision tokens, as status lists and as part of SD-JWT.
What the decoder shows
- Algorithm, type and key ID from the header.
- The complete payload as formatted JSON.
- Times in readable form.
- The length of the signature in bytes, for example 64 bytes for ES256 or Ed25519.
What the decoder does not do
It does not verify the signature and assesses neither issuer nor key. A token that can be decoded is therefore not automatically genuine or valid. Whether a decision matches mandate and receipt is shown only by the verification.
Typical uses
- Reading decisions: see which action a decision service allowed or denied and for which agent.
- Checking times: issue and expiry time in readable form, to spot clock problems.
- Matching keys: the key ID shows which key a verifying party needs for the signature.
Troubleshooting tips
A JWS must consist of exactly three parts. If the input contains tildes, it is an SD-JWT; use the SD-JWT decoder for it. If the expiry time lies in the past, a verification reports the evidence as expired, even if the signature holds.
Frequently asked questions
Is a JWT the same as a JWS?
A JWT is a set of claims that is usually transmitted signed as a JWS. The decoder reads both forms, as long as they consist of three parts separated by dots.
Why is the signature not shown in plain text?
The signature consists of bytes without readable meaning. The decoder therefore shows only its length; whether it holds is checked by the verification page with the issuer's key.
Can I read encrypted JWTs too?
No. Encrypted JWTs (JWE) cannot be read without a key, and KYA processes no private keys.
Does the decoder also show header claims such as x5c?
Yes. The entire header appears as formatted JSON, including certificate chains or embedded keys. Whether they can be trusted is decided only by verification.
Why do some tokens have no payload?
With a JWS with detached payload, the middle part is empty. The content is then transmitted separately, for example as an HTTP body. In this case, the decoder shows only the header and the signature length.