Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You can decode a readable JWT on your device without uploading it: parse its Base64url-encoded parts with local software or a decoder whose local-only operation you can confirm. But decoding only reveals data; it does not verify the token’s signature or prove that its claims are trustworthy. Treat the contents as untrusted until your application validates the token.
What decoding a JWT reveals
A JSON Web Token (JWT) is a compact way to represent claims for transfer between parties. A common signed form uses JWS compact serialization: three Base64url-encoded components separated by periods—header, payload, and signature. Decoding the first two components can show the header and claims when they are readable. Base64url is an encoding, not encryption, so this step does not break encryption or establish authenticity. See the format definition in RFC 7519.
Not every JWT has three components. An encrypted JWT using JWE compact serialization has five. Base64url decoding alone cannot reveal its plaintext; that requires decryption with the appropriate key. Nested JWTs are also possible.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Decode a token without uploading it
- Choose a local method. Use software running on your device, or a browser decoder only if you can establish that it processes the token locally. A page opening in your browser does not, by itself, prove that it avoids sending data to a server.
- Keep the token out of remote services. Do not paste a sensitive token into a website unless its local-only behavior is demonstrable and acceptable for your situation. Avoid exposing it through browser extensions, logs, screenshots, or shared debugging output.
- Parse the readable parts. For a three-part signed token, the header and payload are the parts typically decoded for inspection. A local decoder can render their contents as JSON; it does not need to contact an issuer to do that.
- Handle the output as sensitive and untrusted. Claims may contain personal or operational information. Do not rely on readable values as proof that the token is genuine or valid.
Decoding is not verification
Anyone who can read a signed token can decode its header and payload; that does not mean they created or approved it. Verification requires checking the cryptographic signature using the correct key and an explicitly permitted algorithm. The header’s alg value comes from the token and is untrusted input until the verifier applies its own policy.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
RFC 8725 says: “Libraries MUST enable the caller to specify a supported set of algorithms and MUST NOT use any other algorithms when performing cryptographic operations.” A verifier should therefore constrain accepted algorithms rather than blindly obeying the token header. Read RFC 8725, JSON Web Token Best Current Practices.
Successful signature verification is not the whole application-level check. The application must enforce its token profile and, where applicable, compare issuer and audience with trusted configuration, assess the subject as required, and validate time-related claims. A present or plausible-looking claim is not proof by itself.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choosing a safe decoding approach
When selecting a method, check whether processing is local or remote, whether it only decodes or also verifies, whether it supports the token format you have (including encrypted JWE), and whether you control algorithm and key configuration. Also consider whether the token could be exposed through logs, extensions, or other unintended destinations. The JWT standards describe the format and security requirements; they do not certify that any particular decoder keeps data on your device.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
