jwt decoder

runs in your browser, nothing is uploaded

IDLE

stdin

stdout

Made by Maiyarasu S

Paste a JSON Web Token to read its header and payload as formatted JSON, with the times in it shown as dates. Decoding happens in your browser, and the token is not sent anywhere.

What you can paste

A bare token such as eyJhbGciOi…, the same token after Bearer as copied from an Authorization header, or any JSON that holds tokens as string values. A bare token gets a decode jwt button; tokens inside JSON get a jwt badge you can click to expand.

The header and payload are decoded from base64url and shown as a tree. Claims such as exp, iat and nbf show the date they stand for, and selecting the token shows its algorithm and whether it has expired.

What decoding does not do

The signature is not verified. Decoding shows what the token says, but it cannot tell you whether the token is genuine; that takes the signing key and a check on your server. Encrypted tokens (JWE) cannot be read here either.

Tokens are often credentials. Nothing is uploaded, but what you paste is saved in this browser between visits, so on a shared computer use “clear saved data” in the help dialog when you are done.

Questions

Is it safe to paste a token here?

The token stays in this page and is not uploaded. It is saved in this browser until you clear it, so treat a live token with the same care as a password.

Does it check the signature?

No. It only decodes. Anyone can create a token with any payload, so never trust its contents without verifying the signature on your server.

Why is my token reported as invalid JSON?

Extra text around it, such as a header name, stops it being recognised as a bare token. Paste just the token, optionally after Bearer .

Can it decode encrypted tokens?

No. Encrypted tokens (JWE) have five parts and cannot be read without the key. Only tokens with a readable header and payload can be decoded.

Related tools

help

QUERY (the prompt line)

Type a path or a filter after guest@json:~$. JSONPath and a jq-style subset both work, and the output shows only the result. Convert, copy and save then apply to that result.

$.users[0].nameone value by path. .users[0].name is the same thing
$["odd key"] $.ports[-1] $.ports[1:3]quoted keys, counting from the end, slices
$.users[*].name or .users[].nameevery item
$..namethat key at any depth
$.users[?(@.id > 1001 && @.sudo)]filter. Operators: == != < <= > >= && || !
.users[] | select(.sudo) | .namethe same idea in jq style, with pipes
.users | map(.name) | sortbuild a new list
[.users[] | select(.sudo)] | lengthcollect matches into an array, then count

Functions: length, keys, keys_unsorted, values, type, first, last, sort, sort_by(f), unique, reverse, flatten, add, min, max, to_entries, not, select(f), map(f), has(k), test(regex), contains(x), startswith(s), endswith(s).

TABS A AND B

stdin has two tabs. diff compares a with b by structure: key order is ignored, and an item inserted into an array counts once. validate checks tab a against the JSON Schema in tab b. Click any row in either list to open that spot in the tree.

REPAIR

When input is not valid JSON, the error view lists what auto-fix would change, line by line, before you apply it: comments, trailing or missing commas, single or smart quotes, bare keys, NaN and Infinity, hex and other number spellings, markdown code fences, JSONP wrappers, and input that was cut off. undo brings your original back.

VALUE HINTS

Links are clickable. Numbers that look like Unix times show the date. A badge after a string means it holds something: {…} JSON, jwt a token (decoded, never verified), b64 base64 text. Click the badge, or press Enter on the row, to expand it in place. A token pasted on its own, with or without Bearer in front, is offered as decode jwt instead of a parse error. Decoding never checks the signature.

KEYS

Ctrl+F or /search the output: the tree, or the text of minify, yaml, csv and ts. Enter next match, Shift+Enter previous. Write /pattern/ for a regular expression. In text output the keys and values buttons are off, and diff and validate switch to the tree
Alt+Qgo to the query prompt. Esc clears it
↑ ↓ ← →move in the tree. Left and right fold and unfold, with Shift they do the whole branch
Enter / Ctrl+C in the treefold or expand the row / copy the selected value
Ctrl+Enterformat stdin in place
Ctrl+Ssave the output as a file
Alt+C Alt+M Alt+S Alt+Fcopy, pretty or minify, sort keys, fold
Alt+1 Alt+2 Alt+Ttab a, tab b, next theme
Tab / Shift+Tab in stdinindent and outdent. Press Esc first to tab out of the box instead
Ctrl+Z / Ctrl+Shift+Z in stdinalso undo and redo format, auto-fix, load and clear

On a Mac, use Cmd for Ctrl and Option for Alt.

SAVED INPUT AND DISPLAY

Both tabs are kept in this browser between visits, however large. If the browser cannot keep an input, a note says so. The crt button turns scanlines and glow off. The page also drops them, and brightens dim text and borders, when your system asks for more contrast.

PRIVACY

Everything runs in this page, and the fonts are served with it. Nothing you paste is sent anywhere. A share link holds the compressed input inside the link itself, so anyone you send the link to can read it.

What you paste is also saved in this browser, so it is still here on your next visit. On a shared computer, or after pasting a secret, clear it. This removes both tabs and your settings from this browser.