● Free tool · 100% client-side · nothing uploaded

Decode & security-check a JWT

Paste a JSON Web Token to see its header and claims in plain view, with expiry decoded to real dates — and a security pass that flags alg:none, missing or excessive expiry, and weak algorithms. Everything runs in your browser.

Header

Payload (claims)



Note:Decoded, not verified. A JWT's header and payload are base64url-encoded, not encrypted — anyone can read them. This tool does not check the signature (that needs the key, which you should never paste anywhere).






100% client-side · your token never leaves this page · this page sends nothing to us — open DevTools → Network and check, or decode with your Wi-Fi off




What's actually inside a JWT


A JSON Web Token is three base64url-encoded parts separated by dots: header.payload.signature. The header says which algorithm signed it; the payload holds the claims (who the token is for, when it expires, what it can do); the signature proves it hasn't been tampered with — if you have the key to check. Critically, the first two parts are encoded, not encrypted: anyone holding the token can read every claim. Never put a secret in a JWT payload.


The claims that matter for security


exp (expiry) is the big one — a token with no exp, or one valid for months, is a credential that stays dangerous long after it leaks. alg matters too: alg:none means unsigned (forgeable), and a server that accepts it is critically vulnerable. Short lifetimes and a strong, fixed algorithm are the baseline.


Related free tools
Production-ready checkerScore your deployDeploy error decoderDecode any deploy errorCORS config generatorFix CORS the right wayCache-Control builderBuild a Cache-Control header
All free tools →


Related guide
JWT errors: expired / malformed / invalid signature




A token is one credential. What governs the system it unlocks?


Decoding a JWT shows its claims, not what the credential can actually do. For configured managed paths, Infraveil can apply scoped credentials, the selected manual, exact-hash allowlist, or automatic release mode, and bounded action evidence. It does not govern every actor or token across a production backend.

See the live demo →



Frequently asked questions


Is it safe to paste a JWT here?


Decoding runs entirely in your browser — nothing is uploaded. Still, a JWT is a credential; only paste tokens into tools you trust. This one works offline.


Does this verify the signature?


No — that needs the key, which you should never paste into a web tool. This decodes + flags risky settings. Decoding ≠ verification.


What does alg:none mean?


The token is unsigned and forgeable. A server accepting alg:none is critically vulnerable; it must reject it.