Dev Tools, 7 tools

Converters, 4 tools

Text Tools, 5 tools

Color Tools, 2 tools

Generators, 3 tools

Image Tools, 4 tools

PDF Tools, 6 tools

Calculators, 4 tools

Open tools · 0

About

JWT Decoder

Paste a JSON Web Token and read its header and claims, every date in your own time zone and every registered claim explained. Give it the secret, a public key or the issuer’s key set and it checks the signature, and when that fails it says why: the wrong key, a key of the wrong kind, a secret in the wrong form.

What it does

  • Finds the token in what you paste: after Bearer, in a cookie, a callback URL, or an OAuth response holding several.
  • Header and claims as coloured JSON, with numbers of twenty digits kept exactly and a claim given twice flagged.
  • Every registered and OpenID Connect claim explained; exp, iat and nbf as dates in your zone, with how long ago.
  • Verifies HS, RS, PS and ES at 256, 384 and 512, and EdDSA, with a PEM, a certificate, a JWK or a key set.
  • Says why it failed: the wrong kind of key or curve, a secret meant as Base64, a DER signature, an unknown kid.
  • Catches a token signed with a public key as its HMAC secret, the algorithm confusion attack, and one signed with jwt.io’s example secrets.
  • Warns of alg none, a key URL in the header, a date in milliseconds, no expiry, and secrets in the claims.

How to use it

  1. Paste the token, or whatever it came in.
  2. Read the claims, and whether the dates let it through now.
  3. Paste the secret or the public key to check the signature.
  4. If it fails, follow the reason it gives.

What it does not do

  • Fetching the issuer’s keys: the page makes no requests, so it links to the issuer’s discovery document and you paste the key set.
  • Decrypting an encrypted token (JWE): that takes the recipient’s private key, which should never be pasted into a web page.
  • Signing new tokens: that takes the private key or the production secret, the two things a page should never hold.
  • ES256K and Ed448: the browser’s own cryptography has neither curve.

Questions

Is it safe to paste a token here?

The token is decoded and checked in your browser; nothing is sent anywhere or kept after you close the window. Even so, a live token is a password for as long as it lasts: prefer an expired one, or one from a test system.

Why does my signature not verify?

The tool names which of the usual causes it is: a public key where a secret is needed or the reverse, the wrong curve, a secret that was meant as Base64, an ECDSA signature in DER instead of r and s, or a token changed after signing.

What is the algorithm confusion attack?

A server that lets the token choose the algorithm can be sent an HS256 token signed with its own public key as the secret. The tool tries exactly that when you give it a public key, and names it when it verifies.

Is a JWT encrypted?

A signed JWT is not: anyone who holds it can read every claim, which is all this tool does before you give it a key. Only the signature needs the key, and only an encrypted token (JWE) hides its claims.

Everything here runs in your browser. Nothing you type, paste or open is uploaded, and there is no account and no queue. How that works.

Often used with

More in Dev Tools

  • Regex Tester: Test JavaScript regular expressions live: highlighted matches, capture groups, replace, and a plain-English explanation.
  • Hash Generator: Hash text or files with MD5, SHA-1, SHA-2, SHA-3, BLAKE3, CRC-32 and more; verify a checksum; compute an HMAC.
  • URL Encode & Decode: Percent-encode or decode text for a URL with the kinds of escaping told apart, and take a link apart: edit its query, strip its tracking, see its real host.
  • Cron Expression Parser: Read a cron expression in plain English, see its next runs in any time zone and what a clock change does to them, or build one; Unix, Spring, Quartz and EventBridge.

All toolsAbout utilbrewPrivacy