JWT decoder
Paste a JSON Web Token to read its header and payload — decoded in your browser, not uploaded to our servers for processing.
Tool processing runs in your browser — your pastes/files are not uploaded to our servers for processing.Details
Security note. Treat production tokens carefully. Anyone who sees a valid JWT can use it until it expires. Prefer staging tokens; never put secrets in the URL.Processing stays in your browser — inputs are not uploaded to our servers for processing.
Header
Payload
Decode by default. Signature verify is optional and HS256-only. Never trust a token’s contents without validating it on your server for production traffic.
Frequently asked questions
How do I decode a JWT?
A JWT has three Base64URL parts separated by dots: header.payload.signature. Paste it and the header and payload JSON are decoded and pretty-printed. This runs in your browser — the token is not uploaded to our servers for processing.
Does this verify the signature?
Optionally for HS256: enter the shared secret and we verify with Web Crypto in your browser. RS256/ES256 need public keys — use your server for those. Never trust a token in production without server-side validation.
What is alg:none?
Some libraries historically accepted tokens with "alg":"none" and an empty signature — a known attack. This tool flags alg none (and empty alg) so you notice insecure tokens immediately.
Is it safe to paste a real token here?
Decoding and optional HS256 verify happen entirely in your browser. Still treat production tokens carefully — anyone who sees a valid token can use it until it expires.
What are exp and iat?
exp is the expiry time and iat is the issued-at time, both Unix timestamps. This tool shows them as dates plus a live countdown to expiry.
Debugging LLM API responses? TryTokka watches AI API spend — same maker, optional.