Free tools
JWT Decoder
Paste a JSON Web Token to read its header and claims, see when it expires, and catch the mistakes that let tokens be forged or live too long.
No network. Nothing you enter leaves this tab. There is no request to any server when you paste, decode or copy, and the page keeps working if you go offline after it loads.
Results
Decoded header, payload and warnings appear here.
Reading the results
- alg is none
- The token carries no signature. If a server accepts it, anyone can change the user id or role and the server believes them. Send this token to the endpoint it came from: anything other than a 401 is a finding.
- HS256 from an identity provider
- Providers that publish keys (Okta, Auth0, Entra ID, Cognito, Keycloak) sign with RS256 or ES256. An HMAC token claiming one of them is how algorithm confusion looks: the attacker signs with the public key as the HMAC secret. The fix is on the verifier, which must pin the algorithm.
- No exp
- The token is valid until the signing key changes. Logging out, resetting a password or disabling the account does nothing to a copy someone already has.
- Long lifetime
- Anything over a day is flagged. Access tokens should live minutes to an hour; long sessions belong to refresh tokens the server can revoke.
- jku, x5u, jwk or x5c in the header
- The token is telling the server where to find the key that verifies it. A server that follows that hint will verify a token signed with the attacker's own key.
- Decoded is not verified
- Anyone can decode a JWT, which is all this page does. The signature is what makes it trustworthy, and only the server holding the key can check it. If a claim is secret, it should not be in the token.
A token is a credential until it expires. This page keeps it in the tab, but treat it like a password everywhere else, and don't paste live production tokens into tools that send them to a server.