JWT decoder

Why this one is worth caring where it runs

A JWT in your clipboard is, more often than not, an unexpired session. It is not a hash or a fingerprint — it is the credential itself. Anything holding it can act as you until it expires.

Every online JWT decoder that posts the token to a server has, at that moment, been handed exactly that. Most are run by people with no interest in your token; that is not the same as it being safe, and it is not something you can check.

This page decodes in the tab. Nothing is transmitted, and a browser test asserts that decoding a token issues no network request at all — the claim is tested rather than merely written.

A JWT is not encrypted

This surprises people who assume the opaque string is hiding something.

The header and payload are base64url, not encryption. Anyone holding the token can read every claim in it without a key, which is what this page is doing. The signature does not conceal the contents; it only proves they have not been altered.

So never put anything in a JWT you would not put on a postcard. No passwords, no personal data you would not hand to whoever ends up holding the token.

What the page tells you that the raw JSON does not

Expiry, in readable form. exp, iat and nbf are epoch seconds, which nobody reads at a glance. They are resolved to local times, and the page says plainly whether the token has expired.

No expiry at all. A missing exp is reported as its own fact rather than as “not expired”. A token that never expires on its own is a much more alarming thing than one that expired yesterday, and conflating the two hides it.

alg: none. A token declaring no algorithm carries no signature, so nothing about it is trustworthy. It was the basis of a well-known class of authentication bypass, where a server was tricked into accepting none for a token it should have verified.

An unusually long life. Anything valid for more than thirty days is flagged, because a long-lived bearer token is a credential with no practical revocation.

Verifying is a different operation

This decodes; it does not verify. Checking a signature requires the key, and pasting a signing key into a web page is a worse idea than pasting the token — the key signs every token, not just this one.

Verify on the server that issued it, or with a local tool holding the key.

Nothing is uploaded

Decoded entirely in this page. The token is not stored, not logged and not sent.