Read JWT
Paste a token and see what it contains. We do not verify the signature, and never will: doing so would need your secret key, and this is not a place to paste one.
Your text stays on your device: nothing is uploaded
Result
Paste something on the left: the result appears as you type.
How it works
A JWT is three pieces separated by dots, and the first two are plain JSON encoded in Base64: anyone can read them, with no key and no permission. That is not a flaw in the format — a token is not meant to hide what it contains, but to stop anyone changing it, and the signature is what guarantees that. Which we do not check: verifying it needs the server’s secret key, and a web page is not where you paste one of those. So treat what you read here as untrusted: it says what someone wrote in the token, not that it is true. The dates deserve their own note, because that is where people go wrong: JWTs count seconds since 1970, JavaScript counts milliseconds, and confusing the two always lands you in 1970. We convert them and tell you whether the token has expired. The token stays on this page.
What you paste is never uploaded. Anywhere.
Not to a server of ours, not to a third party, never. The text you type stays in your browser’s memory: it is read, processed and shown here, and you copy it. There is no path that takes it elsewhere, because there is no server to send it to. You can paste something confidential.
- Processed locallyThe computation happens on this page, using the browser’s own engine: no request goes out while you type.
- Nothing to upload, nothing to wait forOther services send your file to a server and then send it back to you. Here the file never leaves: there is no upload to wait for.
- No accountNo sign-up, no email, no daily limits to get around by paying.
- Nothing to deleteOthers promise to delete what you paste after an hour. We have nothing to delete: it never reached us.