To decode a JWT offline on Windows, split the token at the dots, base64url-decode the first two parts (the header and the payload), and read the JSON. You can do that in PowerShell with a few lines that read the token from the clipboard, or with PrismKit, a free Windows developer toolbox from Automata Labs whose JWT inspector, Base64 decoder and epoch converter run entirely on your PC from a keyboard-first command palette. Either way, the token never leaves your machine, which matters because a JWT is often a live credential.
Decoding is not verifying. Anyone can read a JWT’s claims; only checking the signature with the right key tells you whether to trust them. This guide covers reading a token safely, and where reading stops.
Decode JWTs, Base64 and epoch timestamps offline from a hotkey, with nothing sent anywhere.
Get it from Microsoft
Why not paste a JWT into a website?
An access token or ID token usually grants access to something until it expires. Pasting it into a web page means trusting that page, its scripts and its operator with that access, and you usually cannot check what the page does with it. Many company security policies forbid putting credentials into third-party sites for exactly that reason. A token copied from a production log or a browser’s developer tools is also likely to contain personal data in its claims: names, email addresses, tenant or user IDs.
Decoding locally removes the question. The decode is simple enough that it never needs a server.
What is inside a JWT?
A JSON Web Token in its common signed (JWS compact) form is three base64url-encoded parts separated by dots:
| Part | Contents | Example after decoding |
|---|---|---|
| Header | The token type and signing algorithm | {"alg":"RS256","typ":"JWT","kid":"..."} |
| Payload | The claims | {"sub":"1234","iss":"https://login.example.com","exp":1760900000} |
| Signature | Bytes computed over the first two parts with the issuer’s key | Not JSON; used for verification only |
RFC 7519 defines the registered claims. The ones you will look at most:
| Claim | Meaning |
|---|---|
| iss | Issuer: who created the token |
| sub | Subject: who the token is about |
| aud | Audience: who the token is meant for |
| exp | Expiration time: on or after this, the token “MUST NOT be accepted for processing” |
| nbf | Not before: before this, it must not be accepted |
| iat | Issued at |
Base64url is ordinary Base64 with two characters swapped (- for + and _ for /) and the trailing = padding usually removed, so URL-safe text survives in headers and query strings.
How do you decode a JWT in PowerShell?
Copy the token to the clipboard, then run:
$jwt = (Get-Clipboard).Trim()
$part = $jwt.Split('.')[1].Replace('-','+').Replace('_','/')
switch ($part.Length % 4) { 2 { $part += '==' } 3 { $part += '=' } }
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($part))Change the index from 1 to 0 to read the header instead. The switch restores the padding that base64url drops; a remainder of 1 means the text is not valid base64url.
Reading from the clipboard is deliberate. PSReadLine, the line editor in current PowerShell versions, saves your command history to a file under $Env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine, and Microsoft’s documentation warns that “the history can contain sensitive data including passwords.” PSReadLine filters out lines containing words such as password, token, apikey and secret, but a line like $jwt = 'eyJhbGci...' contains none of them and would be saved with the token in it (about_PSReadLine). With Get-Clipboard, the history holds only the command.
How do you read exp, nbf and iat?
They are NumericDate values: per RFC 7519, the number of seconds since 1970-01-01T00:00:00Z UTC, ignoring leap seconds. In PowerShell:
[DateTimeOffset]::FromUnixTimeSeconds(1760900000).ToLocalTime()1760900000 is 19 October 2025, 18:53:20 UTC, which is 14:53:20 in Toronto (EDT). Two common mistakes:
- Milliseconds instead of seconds. A 13-digit number is milliseconds, used by JavaScript’s Date. JWT claims should be seconds; use FromUnixTimeMilliseconds only for values that really are milliseconds.
- Forgetting the time zone. exp is UTC. A token that “expired an hour early” is often a token read in UTC and compared with local time, or the reverse.
Clock skew matters too: RFC 7519 lets implementers allow “some small leeway, usually no more than a few minutes” on nbf and exp, so a token that is seconds past exp may still be accepted by one service and rejected by another.
How does PrismKit decode a JWT?
PrismKit is a keyboard-first, local-only utility belt. Hit the hotkey, type what you need, and the command palette opens the tool.
| Job | PrismKit free core tool |
|---|---|
| Read the header and claims | JWT inspection |
| Decode one base64url part by hand | Base64 and URL encoders and decoders |
| Turn exp or iat into a date | Epoch timestamp converter |
| Pretty-print the claims | JSON formatter and validator |
All of that is in the free core, which PrismKit describes as free forever. It is 100% offline: clipboard data, API keys and JSON payloads never leave your machine, with no tracking and no telemetry. Optional lifetime add-on packs (Enhanced, and Prompt Engineering) add more tools, but you do not need them for JWTs.
Our guides to Base64, URL and JSON encoding and timestamp and UUID generators cover the neighbouring tools.
Inspect a token’s claims and convert its timestamps without opening a browser tab.
Get it from Microsoft
What decoding cannot tell you
Decoding shows what a token claims. RFC 7519’s security considerations are blunt: “The contents of a JWT cannot be relied upon in a trust decision unless its contents have been cryptographically secured and bound to the context necessary for the trust decision.” In practice:
| Question | Can decoding answer it? |
|---|---|
| What does the token say about the user, audience and expiry? | Yes |
| Has it expired? | Yes, compare exp with the current time |
| Was it really issued by this issuer? | No, that needs signature verification with the issuer’s key |
| Has someone edited the claims? | No, edits are only detectable by verifying the signature |
| Is it revoked? | No, only the issuer or its introspection endpoint knows |
Use decoding for debugging: why is the API returning 401, which audience is this token for, did the role claim make it in, has it expired. Use your auth library, with the issuer’s published keys, for trust. PrismKit’s JWT tool is for inspection; it is not a signature validator.
A quick debugging checklist for a rejected token
- Decode the payload and check exp and nbf against the current UTC time.
- Check aud against what the API expects.
- Check iss, including trailing slashes and tenant segments.
- Check the header’s alg and kid against what the API’s key set contains.
- Check scopes or roles the API needs.
- Then look at the server logs for the verification error.
Most 401s are explained by step 1 or 2.
Frequently asked questions
Is it safe to decode a JWT?
Decoding itself is harmless; the risk is where you do it. Decode on your own machine, with a local tool or PowerShell, rather than pasting a live token into a website.
Can I decode a JWT without the secret key?
Yes. The header and payload are only base64url-encoded, not encrypted, in a signed JWT. The key is needed to verify the signature, not to read the claims. Encrypted JWTs (JWE) are different and cannot be read without the key.
Why does my decoded JWT show garbage?
Usually the padding is missing or the base64url characters were not converted. Replace - with + and _ with /, add = padding to a multiple of four, and decode only one part at a time, not the whole token.
Does PrismKit verify JWT signatures?
PrismKit’s free core includes JWT inspection for reading tokens. Use your authentication library with the issuer’s keys to verify signatures.
Does PrismKit cost anything?
The core tools, including JWT inspection, Base64 and epoch conversion, are free. Optional add-on packs are one-time purchases.
Try PrismKit
PrismKit is free in the Microsoft Store, with optional lifetime add-on packs. Install it, set your hotkey, and decode the next token you would have pasted into a browser tab. More detail is on the PrismKit product page.
Install the free core and keep tokens on your own PC.
Get it from Microsoft
Windows and PowerShell are trademarks of the Microsoft group of companies. PrismKit is not affiliated with any identity provider.
Last updated 19 October 2026. Published by Automata Labs, a software company in Canada.