Hack the Hydra
What a JWT contains
A JWT has three parts separated by dots: a header (the signing algorithm, for example HS256 or RS256), a payload with the claims (user id in sub, expiry in exp, issuer in iss, audience in aud...) and a signature. The header and payload are only base64url-encoded, not encrypted: anyone who has the token can read them, which is exactly what this tool does.
Decoding is not verifying
This page does not check the signature, because that needs the secret (HS256) or the issuer's public key (RS256, ES256). A decoded token can therefore be forged. Your server must always verify the signature and the exp, nbf, iss and aud claims with a JWT library before trusting anything inside. A token with "alg": "none" has no signature at all and must be rejected.
Why decode locally
Access tokens are credentials: pasting a live token into a website that sends it to a server can leak access to your account or API. Here the decoding is plain JavaScript in your tab, and nothing is uploaded or logged. Encrypted tokens (JWE, five parts) cannot be read without the key, and the tool says so.
Example
The public sample token from the JWT documentation. The iat timestamp is shown as a date; the signature is reported but not verified.
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output
Header:
{
"alg": "HS256",
"typ": "JWT"
}
Payload:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}
Dates (UTC):
iat: 2018-01-18T01:30:22Z
Signature: 43 characters, NOT verified