JWT Decoder & Analyzer
Paste any JWT to decode its header and payload and flag common security issues. Runs entirely in your browser — your token is never sent to our servers.
Header & payload
Decodes both parts of any JWT instantly.
Common issue flags
Warns on weak algorithms or missing expiry.
Runs in your browser
The token is never sent to any server.
Expiry check
Shows exactly when the token expires.
How it works
A JWT (JSON Web Token) is a base64-encoded header, payload, and signature. This tool decodes the readable parts instantly and highlights common misconfigurations — an alg set to 'none', a missing or far-future expiry, or a weak signing algorithm.
Because JWTs are only encoded, not encrypted, anyone who intercepts one can read its payload — never store sensitive data like passwords inside a token's claims.
Frequently asked questions
Is my token sent to your server when I paste it here?
No — decoding happens entirely in your browser using JavaScript. The token never leaves your device, which matters since a JWT's payload is only base64-encoded, not encrypted.
What does the 'alg: none' warning mean?
It means the token's header claims no signature algorithm was used to sign it. Some poorly configured servers accept this and skip signature verification entirely, letting anyone forge a valid-looking token — this tool flags it as a critical issue.
Related tools
Email Breach Checker
Check if your email was exposed in known data breaches.
Password Security Checker
Test password strength and check if it's appeared in a known breach — both 100% client-side/private.
Email Security Checker
Check SPF and DMARC records to prevent email spoofing.
Technology Detector
Detect CMS, Framework, CDN, Server & Analytics