Read tokens, flatten JSON and translate Unix time privately

JWT decoding is not verification

A common signed JWT has three base64url segments: protected header, JSON claims and signature. The first two are encodings, not encryption. Anyone can change a readable header or payload; a successful decode says nothing about whether a trusted issuer signed it. Do not treat future exp values, permission strings or algorithm names as proof of authorization.

An encrypted compact JWE has five segments. Its protected header remains readable, but its ciphertext requires the correct key and cryptographic validation. This decoder deliberately accepts no keys and leaves JWE payloads encrypted. It does not fetch jku, x5u or JWKS URLs. Keep tokens private because their claims or credentials may be sensitive.

Prepare nested JSON for CSV

Choose the array of records you want to export. A JSON Pointer such as /data/items can select it from an API response; escape a literal slash as ~1 and tilde as ~0. Object fields become flattened columns, with keys from every record included. Arrays can remain JSON in one cell or expand into indexed columns. Dot-path naming escapes punctuation to avoid confusing a literal dotted key with nested fields; JSON Pointer naming is an alternative.

CSV stores strings rather than JSON types. Null, missing and empty text can look identical unless you choose literal null. Quoting preserves delimiters, quotes and line breaks. UTF-8 BOM and CRLF help common Excel workflows, while regional Excel setups may need semicolons. Long numbers and leading zeros can still be changed by spreadsheet auto-detection even when the CSV contains exact literals; import those columns as Text.

Reduce spreadsheet formula injection

By default, formula-like string values and column headers receive a leading apostrophe before CSV quoting. This reduces the risk that a spreadsheet interprets untrusted data as formulas. It changes those exported strings and can remain visible depending on the reader. Disable protection only for trusted data when raw values are necessary, and do not assume a spreadsheet will preserve protection after editing and re-saving.

Choose timestamp units explicitly

Unix timestamps count elapsed time from the UTC epoch. Modern dates often use ten digits for seconds, thirteen for milliseconds, sixteen for microseconds and nineteen for nanoseconds, but digit count is only a heuristic. An old millisecond value can look like seconds. Select a unit explicitly whenever ambiguity matters. This converter uses integer nanoseconds to preserve decimal and negative timestamps without floating-point rounding.

Zones and daylight saving affect calendar input

The same instant has different calendar displays in different zones. A date without an offset is interpreted in the selected zone, not automatically UTC. Some local times are skipped or repeated during daylight-saving changes. The default conversion rejects those cases; earlier/later resolution is an explicit choice that can shift a skipped wall time. Calendar input supports milliseconds, while timestamp input preserves nanoseconds. Leap-second and exponent notation are not accepted.

Local processing and practical limits

Token decoding and timestamp calculations run in the page; CSV conversion runs in a bounded cancellable worker. Files, token claims and text are not uploaded or sent to analytics, and no account or server-side storage is required. Resource limits protect the tab from oversized input; they are not a substitute for cryptographic checks, application authorization, or careful spreadsheet import settings.