JWT Decoder

Decode the header and payload of a JSON Web Token in your browser. Surfaces common-class warnings - alg:none, unsigned tokens, and short HMAC secrets - without sending the token anywhere.

All processing runs locally in the browser. No network request is made with the token.