JWT is base64-encoded, NOT encrypted. Anyone holding the token can read the payload —
in the browser, in a log file, in a support ticket. This page decodes it entirely inside this tab:
no network request, no analytics, no server.
Token
Paste a compact JWS (three parts separated by dots).
Verify signature (optional)
Enter a secret (HS256/384/512) or a PEM public key (RS256/ES256) and press Verify.
Header
—
Signature
—
Payload
—
Timestamps
Security check
Decode a token to run the audit.
Want this offline, with everything unlocked?
JWTLens is a single HTML file you download once and keep forever. No account, no subscription, no upload. Buy once for $17 — or grab all our tools in one bundle.