Tool
JWT decoder
Runs entirely in your browser. Nothing you enter is sent anywhere or stored.
How to use it
Paste a token. The header and payload are decoded and shown, with warnings for alg: none and other weak patterns.
How this works
- I built this to decode only. It never verifies signatures and never asks for a secret or key.
- It warns about
alg: none, missing expiry, remote key URLs (jku,x5u), embedded keys and claims that look sensitive. - Tokens can carry personal data. Nothing you paste is sent or stored. Even so, I would not paste a live production token into any website.