Decode a JWT
Pasting a live token into an online decoder hands someone a working key to your account. This one runs entirely in the tab, which is the only kind of decoder that is safe to use with a real token.
- Runs entirely in your browser
- Works offline
- No upload
- No sign-up
- No watermark
Loading the tool…
How it works
- Paste the token.
- Read the decoded header and payload; the expiry is flagged if it has passed.
- Optionally enter the secret to verify an HS256 signature.
Why nothing is uploaded
Every operation on this page is done by code running inside your browser tab, using the same engine that renders web pages. The file is read from disk into your tab’s memory, transformed there, and written back out as a download. It is never sent anywhere — not to us, not to a third party.
Verify it yourself
- Open your browser’s developer tools (F12) and select the Network tab.
- Load your file and run the tool.
- The only requests you will see fetch the tool’s own code — and, for a few heavy tools, their open-source engine from a public CDN — plus one small page-view ping to loreatec.jp (page address and title, nothing more). None of them carry your file.
Frequently asked questions
Why is decoding a JWT not a security problem, but pasting one is?
The contents are only encoded, not encrypted: anyone holding the token can read them, so reading is not the risk. The token itself is: it works as a key to your account until it expires. Paste it into someone else’s website and you have handed them your login.
Can it verify RS256?
Not yet — only HS256, which needs just the shared secret. Checking RS256 needs the issuer’s public key in JWK or PEM form, which would need more interface than it is worth here.