JWT decoder
Paste a JSON Web Token to read its header and claims and to check it for risky settings. The token stays in your browser.
Nothing leaves your browser: the token and any secret you enter are processed on this page only.
How it works
A signed JSON Web Token has three parts separated by dots: a header, a payload of claims and a signature. The first two are only Base64url-encoded, so anyone holding the token can read them. This tool decodes them on your device, shows the time claims as dates and checks the settings that most often cause security problems. It also tries a short list of secrets from tutorials and default configurations, because tokens signed with them can be forged by anyone.
Reading the result
Problems need fixing: an unsigned token, no expiry or a well-known secret. Warnings depend on context; a missing audience is harmless if only one service accepts the token. Decoding is not verification. Only a signature check with the right key shows that a token is genuine and unchanged, and the server must also fix the algorithm it accepts instead of trusting the header.
Limitations
The tool verifies HS256, HS384 and HS512 signatures with a secret you enter. It cannot verify RS, PS, ES or EdDSA signatures, and it cannot read encrypted tokens (JWE), which have five parts.
Questions
Is my token sent anywhere?
No. Decoding, the checks and signature verification all run in your browser. Even so, treat live tokens like passwords and paste them only into tools you trust.
Why is alg none dangerous?
The token has no signature, so anyone can change its claims. Some libraries used to accept it when the server did not insist on a specific algorithm.
How long should a JWT be valid?
As short as practical. Access tokens typically expire within 5 to 60 minutes; longer sessions use refresh tokens that the server can revoke.
Can I verify RS256 tokens here?
No. That needs the issuer’s public key, usually published at its JWKS endpoint. Verify those tokens in your JWT library with a fixed key and algorithm.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Penetration testingRelated articles
-
A practical WordPress security checklist
Twelve WordPress hardening steps in a sensible order, from updates and abandoned plugins to 2FA, XML-RPC, backups, file integrity and a WAF.
-
Security headers that matter, and the ones to retire
A practical guide to CSP with nonces, HSTS and preload, frame-ancestors, Referrer-Policy, Permissions-Policy and COOP, with examples and what to drop.
-
How to design and test secure file uploads
A checklist of controls for file upload features, based on the OWASP cheat sheet, with a table of tests to run against each upload endpoint.