JWT decoder
🔒 Runs locally in your browser. Nothing you enter is uploaded.
How to use it
- Paste a JWT (three dot-separated parts).
- Review the decoded header and payload.
- Fix any findings flagged as critical or warning.
Frequently asked questions
Does decoding verify the signature?
No. Decoding only reads the token. Your server must verify the signature with a fixed algorithm and key.
Are JWT payloads encrypted?
Standard JWTs are only signed and encoded, so anyone can read the payload. Never put secrets in claims.
More free security tools
🔑🎲#️⃣🔁📊🌐
Password strength checker
See how long a password would survive offline cracking, and why.
Password generator
Cryptographically random passwords and memorable passphrases.
SHA-256 hash generator
SHA-1/256/384/512 of text or a file, and compare against a known hash.
Base64 encoder/decoder
Base64, Base64URL, URL, Hex, HTML entities and ROT13, both ways.
CVSS calculator
Score a vulnerability and get its vector string.
Subnet calculator
Network, broadcast, host range and mask for any IPv4 CIDR.