JWT Decoder
Read a token without handing it over.
Read a token without handing it over.
How to use it
- Paste the token. All three parts, dots included.
- Read the claims. Timestamp claims are rendered as dates and marked past or future.
- Check the signature elsewhere. This decodes only. It does not verify, and it says so.
When you would use this
A JSON Web Token is three base64url segments separated by dots, and reading one should not require handing it to anybody. That is the whole argument for this page. The tokens people paste into a decoder are almost never test data. They are live tokens from a staging environment or from production, pasted in the middle of debugging something, and every hosted decoder receives a copy of each one along with whatever identity it grants. This runs in the page, so there is nothing to receive it, and you can confirm that by pulling the network cable and watching it keep working. The decoding itself has one detail worth knowing: a JWT uses the URL safe alphabet, which differs from standard base64 in two characters. Decoders built on the standard alphabet fail on any token whose payload happens to contain them, which is a surprising number of them. This accepts both. Timestamp claims are rendered as dates and marked past or future, since an expiry as a ten digit number tells you nothing at a glance. It does not verify the signature and says so on every result. Verifying needs the key, and no tool should be asking you for that one.
Questions
- Does this verify the signature?
- No, and it will not. Verifying needs the signing key, and a tool that asked you to paste your signing key would be asking for the one secret that actually matters. A decoded token is not a trusted token: reading claims out of one without verifying it somewhere else is a security bug rather than a shortcut.
- Is my token sent anywhere?
- No. This is the reason to use this one. The tokens people paste into a decoder are routinely live tokens from a staging or production system, and every hosted decoder receives a copy of each one. This runs in the page, so there is nothing to receive it.
- Why does it handle tokens other decoders reject?
- Because a JWT is base64url encoded, not base64. The two differ in two characters, so a decoder using the standard alphabet fails on any token whose payload happens to contain them. This accepts both.