Base64 and JWT decoder
Encode or decode Base64, and read what a JWT says: header, claims and expiry. Everything runs in your browser and nothing is uploaded.
Runs in your browser, nothing is uploadedBase64
Base64 is an encoding, not encryption: anyone can decode it. Never treat it as a way to hide secrets (for example in Kubernetes Secrets or CI variables).
JWT decoder
Try an example:
Header
Payload
Times
Notes
This only decodes. It cannot tell you whether a token is genuine, because that needs the signing key. Treat live tokens like passwords: this page sends nothing anywhere, but avoid pasting production tokens into any website you do not control.
How to use the JWT decoder
- Paste a token into the JWT box and press Decode JWT. You see the header, the claims and the issue and expiry times.
- Use the Base64 box to encode or decode any text. Choose URL-safe encoding for values used in URLs or tokens.
- Read the notes. They flag expired tokens and settings such as "alg": "none".
Example: why a login keeps failing
An API rejects a token. Decoding it shows the "exp" time passed ten minutes ago, so the fix is a token refresh, not a code change.
Another time the "aud" claim names the staging app while the request goes to production. The token is genuine, just meant for a different service.
Common questions
Does decoding prove a JWT is genuine?
No. Anyone can decode a JWT. Proving it is genuine needs the signing key, which your server checks.
Is Base64 a way to hide passwords?
No. Base64 is encoding, not encryption, which is why Kubernetes Secrets need RBAC and encryption at rest.
Should I paste production tokens?
Nothing leaves your browser, but treat live tokens like passwords and prefer expired or test tokens.
Read next: Base64 is not encryption: Kubernetes Secrets and JWT mistakes
Want the real numbers for your AWS account?
Send me your setup and I will return a written list of savings and security fixes, safest first. It is free.