JWT -> READABLE · Local tool
JWT Decoder
Decode a JWT, read its claims, and see when it expires. Nothing is sent anywhere.
Last updated
How do I decode a JWT safely?
Decode it in your own browser and never paste the signing key anywhere. A JWT's header and payload are base64url encoded, not encrypted, so anyone holding the token can already read them: filetity decodes both in the page, pretty prints the JSON, turns the exp, nbf and iat claims into real dates with how long away they are, and explains the registered claim names. It flags an algorithm of none, a missing expiry, a token not yet valid and an empty signature. It does not verify the token, because verification needs the secret that mints tokens and no website should be given that.
01 / Your device
the file stays here
02 / Browser memory
the work runs locally
03 / Back to you
saved on this device
When you would use this
Situations, not settings.
- An API keeps answering 401 and nobody knows why
- The expiry, the audience and the issuer are right there in the payload, and three quarters of the time one of them is the answer.
- A token from a system you did not build
- The claim names are explained as they are shown, so you can see what the issuer is asserting without reading their documentation first.
- Checking what a client is actually sending
- Paste it straight out of the Authorization header, Bearer prefix and all, and see whether it is the token you think it is.
How it works / no cloud
A conversion engine, not an upload form.
A JWT is three base64url segments joined by dots, and only the third is a signature. The first two are encoded, not encrypted, so this page decodes them and pretty prints the JSON, converts exp, nbf and iat from seconds since 1970 into real dates with how long ago or away they are, and explains the registered claim names as it goes. It warns about the things that actually bite: an alg of none, a missing exp, a token that has expired or has not started yet, an empty signature. What it deliberately does not do is verify, because verifying needs the signing key and pasting that into a website hands over the ability to mint tokens.
- Offline ready
- Installable app
- No file limit queue
Straight answers
No accordion. Nothing hidden.
- Is it free?
- Yes, with no watermark and no page limit.
- Does it need an account?
- No. There is no account system.
- Is my file processed on my device?
- Yes. The file is read by your browser and never uploaded. There is no server to send it to.
- What formats are supported?
- A JWT, with or without the Bearer prefix. A five segment JWE is named as encrypted rather than reported as broken.
- What are the limits?
- The signature is shown but never checked, and no key is ever asked for. Length is limited only by what fits in a text box.
- Does it work on mobile?
- Yes, on any modern mobile browser. Large files are limited by the memory the phone gives the browser.
- Does it work offline?
- Yes, once the page has loaded. The tool keeps working with no network connection.
- Is it safe to paste a token into a decoder?
- Into this one, yes, because it never leaves the tab: no request is made and there is nothing here to receive it. Into a decoder that posts it to a server, no. A working token is a live credential, and whoever receives it can act as you until it expires, which is why the honest version of this tool runs on your own machine.
- Why can it not tell me whether the token is valid?
- Because validity is the signature, and the signature can only be checked with the key it was made with. That key is the one your server signs every token with, so pasting it into a web page gives a stranger the power to issue tokens your systems will accept. No page that asks for your signing key should get it.
- What does alg none mean?
- That the token carries no signature at all, so anybody can edit the payload and the token still looks well formed. It exists in the specification for tokens whose integrity is guaranteed some other way, and it has been the root of real authentication bypasses in libraries that accepted it by default. A token arriving with it is worth investigating.
- My token shows as expired but it still works. Why?
- The clock. exp is compared against this device's time, and a machine running a few minutes fast will call a token expired slightly early, while most servers allow a small amount of skew in the other direction. If the dates look wildly wrong rather than slightly, check whether the value was written in milliseconds, which is a common bug and puts the expiry fifty thousand years out.
Keep working locally
3 available · more coming