JSON Web Tokens (JWTs) are widely used to carry authentication and session data between services. This tool decodes a token's header and payload directly in your browser — no network request is made at any point, so you can safely inspect a real token from a live system.
Try it now
Decoded entirely in your browser — nothing is sent anywhere, no network call is made at all. This only decodes the token; it doesn't verify the signature, since that would require the secret or public key it was signed with.
How to use this tool
- Paste a JWT into the box above — or click Try an example to see a sample token.
- Click Decode.
- Review the decoded header, payload, and any risk flags (like an insecure algorithm or missing expiry).
What this tool checks
A JWT has three parts — header, payload, and signature — separated by dots. This tool decodes the header and payload (both are just base64url-encoded JSON) and flags two common issues: an alg of none (a well-known vulnerability class where a token can be forged with no valid signature at all), and a missing exp claim, meaning the token never expires on its own.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, signed piece of data commonly used to represent a user's identity or session in web applications and APIs. It consists of a header, a payload, and a signature.
Is it safe to paste a token into this tool?
Yes — decoding happens entirely in your browser using JavaScript; the token is never sent over the network to Wuluf or anyone else. That said, treat any real token as sensitive and avoid pasting one into any tool you don't trust, this one included — always check what a tool claims to do against how it actually behaves.
Why does alg: none matter?
A JWT signed with alg: none has no cryptographic signature at all. If the server verifying the token doesn't explicitly reject this algorithm, an attacker can forge a token with arbitrary claims — a well-documented, serious vulnerability class.
Does this tool verify the signature?
No — decoding and verifying are different things. Verifying a signature requires the secret or public key the token was signed with, which this tool never has access to. It only decodes and displays what the token claims.
Wuluf's Penetration Testing service can help. Ethical attacks that expose real weaknesses before the adversary does.