Decode a JWT

What is inside this token, without pasting it into a website?

Header and payload, decoded locally. The reason to use this one rather than the popular one is the whole reason it exists: a JWT is a credential, and the usual decoder receives it.

token

HS256 The algorithm the header claims. The signature is not checked here - verifying it needs the key, and the key is the one thing that must not be typed into a web page.

ready to paste

expires 2023-11-14 23:13:20 UTC
issued 2023-11-14 22:13:20 UTC
segments 3

out

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "iat": 1700000000,
  "exp": 1700003600
}

how to use it

Paste the token. It is decoded in this tab and the page makes no request at all.
Read the header for the algorithm and the payload for the claims.
Check the expiry row - it is the claim people are usually looking for.

what this page cannot do

This decodes a token you already have in the clipboard. The extension reads the tokens a page is actually holding - in storage, in a cookie, on the request - which is the step before you have one to paste. It never sends any of them anywhere either.

Storage in the panel How much is this site keeping on my machine?

Add LoupeKit

TWO BUILDS 9 browsers

Chrome from the Chrome Web Store Firefox from addons.mozilla.org Edge from Microsoft Edge Add-ons Brave takes the Chrome build Opera takes the Chrome build 4 more the Chrome build

no host permissions · the reading is free