JWT decoder & security check
Decode a JWT, read its claims in plain English, verify its signature and check it for common security mistakes.
DeveloperFreeRuns in your browser
The editor opens full screen. Your files stay in your browser.
Open jwt decoder & security check- 01
Paste a token. The header, payload and signature are split and decoded.
- 02
Read the audit: it flags unsigned tokens, weak secrets, missing expiry and risky headers.
- 03
Verify the signature with your secret or public key, or share a link with the signature removed.
02
FAQ(4)
- Is my token sent anywhere?
- No. Decoding, verification and the audit run in your browser. Open DevTools → Network and paste to check: the only request is the public list of known secrets, which never includes your token.
- Why does the share link drop the signature?
- A full token works as a login until it expires. Without the signature, the link shows what's inside but can't be used.
- How does the weak-secret check work?
- For HMAC tokens, it tries about 104,000 publicly known JWT secrets from SecLists in your browser. A match means anyone can forge tokens. No match doesn't prove the secret is strong.
- Can it decode encrypted tokens (JWE)?
- It shows the header. The payload needs the private key, which this tool doesn't ask for.
Built by Sidd. Need a custom tool?
I build small, focused web tools for teams and products.