JWT decoder

What this tool does

A JWT is three Base64URL segments. This tool decodes the first two as JSON and tells you whether a signature segment is present. It never contacts an identity provider and never verifies HMAC or RSA signatures.

How to use it

1. Paste a token. A Bearer prefix is ignored.
2. Read the warning. Treat every claim as untrusted text.
3. Inspect header.alg, exp, and your application claims.

Privacy

This tool processes files and text locally in your browser. Your content is not uploaded or stored by this site.

ConvertPass does not include your input in analytics, URLs, or error reports. Encoding: UTF-8 JSON inside Base64URL. Limit: 32 KB (32.0 KB).

Limitations

• No signature verification, ever, in this tool.
• Encrypted JWTs (JWE) are not decrypted.
• alg none is displayed, not treated as valid.

Example

eyJhbGciOiJub25lIn0.eyJzdWIiOiJhZGEiLCJpc3MiOiJjb252ZXJ0cGFzcyIsImV4cCI6MTcwMDAwMDAwMH0.

{
  "header": { "alg": "none" },
  "payload": { "sub": "ada", "iss": "convertpass", "exp": 1700000000 },
  "signaturePresent": false,
  "algorithm": "none"
}

This example is an unsigned token for illustration.

Troubleshooting

The header is not valid Base64URL JSON

You may have pasted an opaque session cookie, not a JWT. JWTs contain two dots.

FAQ

Why will ConvertPass not verify the signature?

Verification needs the correct key and algorithm policy. Doing it in a random website would either require you to paste secrets, or it would pretend to verify without them. Both are worse than a clear warning.

Is it safe to paste a production token?

Treat tokens as credentials. This tool stays local, but a screenshot, browser extension, or shared machine can still leak them. Prefer a redacted token or a staging token.

What does signaturePresent mean?

Only that the third segment is non-empty. It is not a cryptographic check. An attacker can attach any bytes.

Can I decode nested JWTs?

Decode the outer token first, then paste an inner token string if your payload contains one.

Does this leak the token into the URL?

No. Tokens are not written to query parameters, history, or analytics.