Decode a JWT
Pasting a live token into an online decoder hands someone a working credential. This one runs in the tab, which is the only version of this tool that is safe to use with a real token.
- Runs entirely in your browser
- Works offline
- No upload
- No sign-up
- No watermark
Loading the tool…
How it works
- Paste the token.
- Read the decoded header and payload; the expiry is flagged if it has passed.
- Optionally enter the secret to verify an HS256 signature.
Why nothing is uploaded
Every operation on this page is done by code running inside your browser tab, using the same engine that renders web pages. The file is read from disk into your tab’s memory, transformed there, and written back out as a download. It is never sent anywhere — not to us, not to a third party.
Verify it yourself
- Open your browser’s developer tools (F12) and select the Network tab.
- Load your file and run the tool.
- The only requests you will see are the tool’s own code and, once cached, none at all.
Frequently asked questions
Why is decoding a JWT not a security problem, but pasting one is?
The payload is only Base64 — it was never secret and anyone holding the token can read it. What is sensitive is the token itself: it is a working credential until it expires. Paste it into someone else’s server and you have given them your session.
Can it verify RS256?
Not yet — only HS256, which needs just the shared secret. RS256 verification requires the issuer’s public key in JWK or PEM form, which is a larger piece of UI than it deserves here.