AnyFormat

00 Utility

JWT Decoder

Header, claims and expiry — and the token never leaves the tab.

01Token
02Header 
 
 
 
 03Payload 
  
 
 
 
 
 
 
 
 
05Verify signature
 

HMAC only (HS256/384/512), checked locally with the Web Crypto API. RSA and
                ECDSA need the issuer's public key, which would require a network request.

  
 
 
 
      
 
   
  
 
 
     
  •  No upload 
The conversion runs in this tab. Your file never travels — not to us, and
      not to the advertising.
 
    •  
  •  No sign-up, no email, no daily cap There is no account system to sign up to. 
    •  
  •  No size limit we invented 
Only your device's memory — about ~2 GB on a desktop browser,
~400 MB on a phone.
 
    •  
  •  Turn your Wi-Fi off and convert anyway 
The conversion needs nothing but this page. Ads will not load without a
      connection; your file will still convert. That is the whole claim, and it
      takes five seconds to check.
 
    •   
 
   
 
 
Paste a JWT to see its header and claims. This is the tool where running locally matters most on the whole site: a JWT is a credential, and pasting a live one into a website hands someone else a working session.
  
 
Why this one really has to be local
 
A bearer token is not a description of a session, it is the session. Anyone holding it can act as that user until it expires. Every online JWT decoder that posts the token to a server is asking you to disclose a live credential to a third party, and the well-known ones say so in their own documentation.

Here the token is parsed by JavaScript in this tab. You can verify that by opening the Network panel, or by turning your Wi-Fi off — the tool keeps working. Nothing is logged, because there is nowhere to log it to.
 
  
 
Decoding is not verifying
 
Anyone can read a JWT: the header and payload are Base64url, not encryption. The signature is what proves the token was issued by whoever holds the key, and checking it requires that key.

If your token uses HMAC (HS256, HS384, HS512) you can paste the shared secret and the signature is checked here, locally, with the Web Crypto API. If it uses RSA or ECDSA (RS256, ES256 and friends) verification needs the issuer's public key, which is normally published at the issuer's JWKS endpoint — and fetching that would mean a network request, which this page deliberately does not make.
 
  
 
The warnings, and what they mean
 
alg: none — the token is unsigned. Any service that accepts it can be handed a forged token by anyone. This was a widespread vulnerability in JWT libraries and still appears in test fixtures that leak into production.


No exp claim — the token never expires by itself. Revocation then requires a server-side blocklist, which is exactly the state most JWT deployments were trying to avoid.


Expired — exp is in the past. Every timestamp is shown as an absolute time, in your local timezone, and as a plain-language interval, because 1516239022 tells you nothing at a glance.
 
  
 
Five parts means JWE, not JWT
 
A token with five dot-separated segments is a JWE — encrypted rather than merely signed. Its payload cannot be read without the decryption key, by design. No decoder can show you its claims, and one that claims to is showing you the header only.
 
  
  
Other names for this
 

Also searched as  “jwt debugger”, “decode jwt token”, “json web token decoder”.

 
  
 
Questions
 
 
 
Is it safe to paste a production token here?
 
Safer than any server-side decoder, because nothing is transmitted. The prudent habit is still to use an expired or test token where you can — but if you must use a live one, this page does not send it anywhere. Turn off your Wi-Fi first if you want to be certain.
 
 
Can it verify an RS256 signature?
 
Not without a network request to fetch the issuer's public key, which this page will not make. HMAC algorithms can be verified locally with the shared secret.
 
 
It says my token is not a JWT.
 
It does not have three dot-separated parts. Opaque OAuth access tokens are common and are not JWTs — only the issuer can interpret them.
 
 
Can I edit the payload and re-sign it?
 
Not here. Producing valid tokens is a signing tool rather than a decoder, and putting one on a public page is a bad idea.