JWT decoder
Decode header, payload and signature of a JSON Web Token in your browser — no data leaves your machine.
The token in three parts separated by dots (header.payload.signature), usually starting with eyJ. It is read only in your browser.
How this tool works
JSON Web Tokens (JWT) are the standard format for authentication and single sign-on (OAuth 2.0, OpenID Connect). A JWT consists of three base64-encoded parts: header, payload and signature. The decoder splits every token in your browser — no server transfer, no logs, no API calls. It also validates standard claims (exp, iat, nbf, iss, aud) and shows whether the token has expired. Optionally you can verify the signature with a shared secret (HS256) or public key (RS256).
Typical use cases
- Debug a broken OAuth integration by reading the access token contents
- On "401 Unauthorized", check whether the token has already expired (exp claim)
- Verify role claims in the token — do they match expected permissions?
- Before deployment, check issuer (iss) and audience (aud) against expectations
- On a suspicious token, identify the signing algorithm used (alg)
Frequently asked questions
Are my JWTs sent to any server?
No. Decoding runs fully in the browser via the JavaScript Web Crypto API. There is no network call, no log, no cookie.
What does "alg: none" mean and is it dangerous?
A JWT without signature. This was a famous 2015 attack: servers accepted "none" JWTs as valid. Modern libraries reject "none" by default — if you see it, your implementation is vulnerable.
Which algorithms are supported for signature verification?
HS256/HS384/HS512 (HMAC with shared secret) and RS256/RS384/RS512 (RSA with public key). ES256 (elliptic curve) is on the roadmap.
Why is exp so important?
Without expiry a stolen token would be valid forever. exp should be 5-15 minutes for access tokens, days to weeks for refresh tokens.
Can the decoder decrypt JWE?
JWE (encrypted JWTs) is not supported currently — only signed JWS tokens. Most auth servers use JWS, JWE is the exception.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.