JWTlens
JWT decoder and inspector
A JWT is encoded, not encrypted
A standard JWT has three Base64url parts separated by dots: header, payload, signature. The first two are plainly readable by anyone holding the token — this page decodes them without any secret, which is the point being demonstrated.
So never put anything confidential in a JWT payload. No passwords, no personal data you would not hand to the bearer, no internal identifiers you would rather not leak. The signature stops the token being altered; it does nothing to stop it being read.
Why decode locally
A JWT is usually a live credential. Pasting a production token into a website means handing that site a working session — the decoder has, by definition, received your credential. Several popular online decoders are perfectly honest about processing server-side, and people paste production tokens into them anyway.
This one runs entirely in the page. If you would rather verify that than trust it, open your network tab and watch: nothing is sent.
Signature verification
Supplying the secret checks an HS256 signature using the Web Crypto API,
again locally. RS256 and ES256 use public-key signatures and are not verified here —
those need the issuer's public key, and a mismatch is far more likely to mean you have
the wrong key than a bad token.
One thing worth checking by eye: if the header says "alg": "none", the
token is unsigned. Any system accepting it has a serious vulnerability.
This tool runs entirely in your browser. Nothing you type, paste or open is sent to util.quest or anywhere else — there is no upload and no request to make one. You can disconnect from the network and it will keep working.
Paste a JSON Web Token and read its header and payload without pasting a production credential into someone else's server. Timestamps are shown as real dates, expiry is checked against the clock, and the HS256 signature can be verified if you have the secret.
It's one of the free tools in the util.quest collection — nothing to install, and no account needed. Found a bug or want a feature? Reach out at [email protected].
