Do you send the token anywhere?

No. Decoding uses the browser only. The JSON API refuses a token and only describes what to look at.

Is a decoded token genuine?

No. Anyone can make a token that decodes. Without the signature check it proves nothing.

What does alg none mean?

The token claims it has no signature. Do not accept it.

Tools · DevOps

JWT decoder

Paste a JSON Web Token. The header and payload are decoded in this browser. The token is not sent to the server, and the signature is not checked.

The token stays in this browser. It is not sent to SuperStack, it is not stored, and decoding it does not mean the signature is valid.

How to use it

Paste the token. It stays on this page.
Read the algorithm, the expiry and the claims. A warning means you should not trust the token yet.
Verify the signature in the system that holds the key. This page cannot do that.

Questions

Do you send the token anywhere?: No. Decoding uses the browser only. The JSON API refuses a token and only describes what to look at.
Is a decoded token genuine?: No. Anyone can make a token that decodes. Without the signature check it proves nothing.
What does alg none mean?: The token claims it has no signature. Do not accept it.

An automated client can POST JSON to /api/tools/jwt with the fields listed in the OpenAPI document. The OpenAPI document is at /api/tools, with a short guide at /llms.txt. Nothing submitted is stored.