Loading
Visitar URL original
Paste any JWT token to instantly decode its header, payload, and claims — everything runs in your browser.
The token is decoded entirely in your browser. Nothing is sent to any server.
A JSON Web Token is a compact, URL-safe format for asserting claims between parties. It has three parts — header, payload, signature — separated by dots and encoded with base64url.
Yes — all decoding happens locally in your browser. Nothing is sent to our servers, logged, or stored. That said, avoid pasting production access tokens into any online tool if you can help it.
Yes. The Verify tab checks HMAC (HS256/384/512) signatures with your secret, and RSA, ECDSA, or PSS signatures with a PEM or JWK public key, all in your browser via WebCrypto. It can also fetch a JWKS URL to pick the right key. Your production apps should still verify server-side.
Decoding just base64url-decodes the header and payload so you can read the claims; it does not prove the token is authentic. Verifying checks the signature against a secret or public key to confirm the token was issued by who it claims and has not been tampered with. This tool does both.
CODERCOPS implements secure auth systems — OAuth2, JWT, SSO, and custom identity solutions — for startups and enterprise apps.