API & Auth
Decode a JSON Web Token and audit it in one step: algorithm safety, expiry, and risky claims — all checked locally.
Your token is decoded locally in your browser. It is never uploaded to our servers — safe for production tokens.
A JSON Web Token is three Base64url-encoded parts joined by dots: header.payload.signature. The header declares the signing algorithm, the payload carries the claims (who the user is, when the token expires, what they may do), and the signature lets a server verify that nobody tampered with the first two parts.
Decoding a JWT needs no key — the header and payload are just Base64. That is also the trap: anyone who intercepts the token can read every claim, so payloads must never contain secrets. And because the server is the only party that verifies signatures, misconfigurations like accepting alg=none or mixing up HMAC and RSA keys turn a well-formed token into a full account takeover.
Most online decoders stop at showing the JSON. This tool goes one step further and applies a rule set drawn from common JWT attack classes: unsigned tokens, weak symmetric keys, missing expiry, overly long lifetimes, absent issuer/audience binding, and sensitive data hiding in claims. Think of it as a quick first-pass audit before you dig in with your own tests.
Decode the token and look at the exp claim. If it is only minutes after iat, your access token lifetime is short by design — your client should be refreshing it.
Before integrating an OAuth provider, paste one of its tokens to see which algorithm it signs with and which claims it exposes — a 30-second sanity check on their security posture.
Scan the payload for sensitive claim names (password, apiKey, phone…). The analyzer flags them as critical, because JWT payloads are readable by anyone who sees the token.
If the analyzer reports missing exp/aud/iss while your verifier requires them, you have found the mismatch without touching server logs.
The decoded payload is displayed pretty-printed; copy it and open our JSON Formatter if you need to restructure or diff it.
Generate strong random passwords with crypto.getRandomValues — pick length and character sets.
Generate cryptographically secure random tokens in hex, base64, or URL-safe base64.
Generate Apache/Nginx .htpasswd entries with bcrypt or {SHA} schemes — fully client-side.
Generate bcrypt password hashes with adjustable cost and verify hashes against passwords.
Looking for something else? Browse all tools