crypto
JWT decoder
Decode a JSON Web Token header and payload. Never verifies remotely.
Runs 100% in your browser. Nothing you paste is uploaded, stored, or sent to a server.
Decode only. DeskKit never verifies a signature and never sends the token to a server.
Header
Payload
How to use
- Paste a JWT (three Base64URL segments separated by dots). Compact header.payload pairs without a signature are accepted.
- Read the pretty-printed header and payload. Registered claims exp, nbf, and iat are also shown as ISO timestamps.
- Treat the output as untrusted display data. A decoded token is not a verified token.
- Clear the box when you are done. The token is not written to localStorage.
A JWT is three segments: a header, a payload, and a signature. The first two are just Base64URL-encoded JSON. Anyone can decode them, and that is often all you need when a user is “randomly” logged out or a claim looks wrong in staging.
DeskKit deliberately stops at decode. It will not call your JWKS endpoint, will not HMAC with a pasted secret, and will not pretend a token is valid because the JSON parsed. Verification belongs in your API, with a key that never enters a website. If a tool offers to “verify” in the browser against a remote JWKS, that is a different and more dangerous product.
Examples
Typical header
{"alg":"RS256","typ":"JWT","kid":"2026-01"} tells you the algorithm and which key id the issuer claims to have used. This page does not fetch that key.
Expiry claim
exp is a Unix timestamp in seconds. The decoder shows the ISO date next to the raw number so you can see whether the token is already stale.
Unverified warning
A token with alg set to none, or with a signature you cannot check, still decodes. That is not success. It is a view of attacker-controlled JSON.
Why decode-only is the point
Online JWT “debuggers” that also verify have become a common place to paste production secrets. Even when the page claims to be client-side, the habit is bad: people type the HMAC secret into a form on a domain they do not operate. DeskKit has no secret field. There is nothing to leak but the token you already pasted, and that token never leaves the tab.
Use this view to check iss, aud, exp, and custom claims. Then verify on the server with your library of record (jose, jsonwebtoken, PyJWT, and so on) against a local key or a cached JWKS.
If you only need the Base64 layer, the Base64 tool can decode a single segment. The JWT decoder is the one that splits, pretty-prints, and interprets time claims.
FAQ
Will you add signature verification?
Not against a remote JWKS, and not as a “paste your secret” HMAC box. Those features train people to put production keys in a browser form. Decode is the product.
What algorithms can I inspect?
Any. The decoder does not run the algorithm; it only reads the header. HS256, RS256, ES256, and EdDSA tokens all display the same way.
Is the token stored?
No. It lives in a form field until you navigate away or clear it. There is no history and no analytics payload with the token.
Can I decode an encrypted JWE?
No. JWE is encrypted, not just signed. Without the key you will only see the header. This tool targets signed JWTs (JWS) in compact serialization.