All tools

JWT decoder

Decode a JWT's header and claims, see when it expires, verify it with a secret, PEM key or JWKS, and sign new tokens, all on your device. Free, with no account or uploads.

Decode and verify a JWT

Paste a token: its header and claims are read on this device, with warnings for alg none, a missing expiry or a well-known secret. Verify it with its key, or make one of your own.

Try one

Everything happens in your browser: what you paste or open is never sent anywhere, and nothing is kept when you leave.

How it works and help

A little help along the way

Follow these steps. Every option is explained underneath. Everything happens in your browser; nothing you paste is sent anywhere.

  1. Paste anythingPaste text into the box at the top. The toolkit says what it may be (Base64, Base64url, Base32, hex, percent-encoding, HTML character references, Unicode escapes, a punycode domain, a data URL, text hiding characters) and why it thinks so. Press a guess to open it with the steps that read it.
  2. Or build a recipeOpen the toolkit, type or paste your input, or open a file, and add steps from the list on the left (on a phone, Add a step). Each step works on what the one before gave, so URL decode then Base64 decode reads Base64 that was put in an address.
  3. Set each step's optionsEach step shows its options: the Base64 alphabet and padding, which characters URL encoding keeps, whether HTML references are written by name or number, the escape style for your language. Move a step up or down or remove it.
  4. Read the notesA step says what it let pass, such as line breaks a Base64 decode passed over or a % that was not followed by two hex digits. When a step cannot go on, it says why and where, and the steps after it wait.
  5. See the resultThe result shows as text, as a hex dump, as a table of its characters with their code points, names and bytes, as a preview when it is a picture, sound, video or PDF, or as an address taken apart when it is one.
  6. SwapSwap makes the result the input and turns the recipe around, so Base64 encode becomes Base64 decode: the quickest way to check that something reads back the same.
  7. Copy, download or shareCopy the result, download it as a file (a picture as a picture), or copy a link to the recipe with its input; the link carries them after the #, which browsers never send to a server.
  8. Make and read IDsUnder IDs, make UUIDs of any version (4 and 7 are the usual ones), ULIDs, NanoIDs, KSUIDs or ObjectIds, one or up to 100,000, as lines, JSON, CSV or SQL. Paste an ID under Read an ID to see what it holds and, for most kinds, when it was made.
  9. Hash text and filesUnder Hashes, type text or add files and their hashes are shown; choose the algorithms, the form (hex or Base64), and a key for an HMAC. Paste a checksum or a SHA256SUMS file to check a download. Under Passwords, make and check bcrypt, Argon2 and scrypt hashes.
  10. Make mock dataUnder Mock data, start from Users, Orders, Nested JSON or Hostile input, or paste a JSON example, a JSON Schema or a CSV header, then change the fields: their kind, options, a share left blank, uniqueness. Choose how many rows, the seed, the language and the file (JSON, CSV, SQL, XML, YAML, TypeScript), and Make: the first rows are shown, and Download has them all.
  11. Test a regular expressionUnder Regex, choose JavaScript, PCRE2 or Go, type a pattern and a text: matches are marked as you type, each pattern run by its own engine. Replace, Split and List use the matches; What it means explains and draws the pattern; tests must or must not match; and a warning comes before catastrophic backtracking. As code writes it in eight languages.
  12. Read and make a JWTUnder JWT, paste a token (with or without Bearer): its header, payload and claims are read on this device, times counting down, with warnings for alg none, a missing expiry or a well-known secret. Verify it with a secret, a PEM key or certificate, a JWK or a key set; decrypt an encrypted one; or make and sign a token of your own.
  13. Read and build a cron scheduleUnder Cron, choose the scheduler (Unix cron, GitHub Actions, Kubernetes, Jenkins, Quartz, Spring, EventBridge or systemd) and type a schedule, or build it field by field: it is said in words, its next runs are listed in any time zone with the days clocks change marked, and it can be written for another scheduler with the file that sets it up.
  14. KeysAlt or ⌥ + I goes to the input, Alt or ⌥ + A to the steps, Alt or ⌥ + S swaps, Alt or ⌥ + C copies the result, Alt or ⌥ + D downloads it, Alt or ⌥ + L copies a link, Alt or ⌥ + N starts again, Alt or ⌥ + 1 to 7 go to Encode and decode, IDs, Hashes, Mock data, Regex, JWT and Cron, and Ctrl or ⌘ + / lists the keys.

Questions people ask

Is it safe to paste a live token here?
The token is read in your browser and never sent, kept or put in a share link; the page makes no request unless you press Fetch the JWKS, which asks the issuer for its public keys and sends no token. Even so, a live token is a key to an account: treat it as a password and prefer an expired one when you can.
Does decoding a JWT check that it is genuine?
No. Anyone can write a header and payload; decoding only reads them. Verify checks the signature with the key, a shared secret for HS256 or the issuer's public key for RS256, ES256 and the rest, and says whether this very token was signed with it.
Where do I find the key to verify a token?
For HS256, it is the secret your service signs with. For RS256, ES256 and the others, it is the issuer's public key, usually published as a key set (JWKS) at an address such as /.well-known/jwks.json; paste it, or fetch it if the issuer allows other sites to read it.

This page is the Developer toolkit, opened for this one job; every other tool it has is one press away. Each of its settings is explained on the Developer toolkit's own page.

Read the step-by-step guide

Guides

Same tool, other jobs

Tools nearby