Decode a JWT, and see what is wrong with it

Paste a token to read its header and payload, and to check it against the mistakes that make one forgeable.

In your browser nothing you paste is uploaded

Token

A JWT is three base64url parts separated by dots. The first two are only encoded, not encrypted, so anyone holding the token can read them. The third is the signature, which is what stops the first two being edited.

This checks one thing. A scan reads your whole repository and tells you what an attacker would find first.

Free scan

More tools

Secret scanner Paste a .env file or a diff and find the keys that should not be in it. CSP evaluator Grade a Content-Security-Policy and see which directive undoes it. SRI hash generator Generate the integrity attribute for a script or stylesheet you load from a CDN. Hash generator MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text, at once. Base64 encoder Encode and decode Base64, including URL-safe, with UTF-8 handled properly.