Free Tools

JWT Decoder

Decode a JSON Web Token
We never receive your token. It's decoded by code running on this page, in your browser. Nothing is sent, stored or logged. Check it yourself: open your browser's network tab, then paste.
Decodes as you paste. Signed (3-part) and encrypted (5-part) tokens.

Why we don't check the signature

Checking a signature needs the key: the shared secret for HS256, or the public key for RS256 and the like. Asking you to paste a secret key into a web page would be worse than asking for the token, so this tool never asks for one.

Verify signatures in your own code, with the key and the accepted algorithm fixed in its configuration.

Why your token stays on this page

A JWT is usually a live credential: whoever holds it can act as you until it expires. A security company has no business receiving one, so this tool is built so that we can't.

The decoding runs in your browser. Nothing you paste goes into the address bar, browser storage, analytics or a request.

Your tokens live in your users' browsers? So does every script that can read them.

If your app keeps tokens where page scripts can reach them, any script on the page can take them. Script Watch tells you when a new script appears on your site.

Start Free Trial Learn More