Paste a JWT and this page splits it into its three parts and reads each one back,
saying what will actually happen.
The most common misunderstanding about JWTs is that the payload is encrypted. It is not:
it is written in base64, and anyone can read it.
Put exp in milliseconds so the expiry lands tens of thousands of years from now, and
nothing raises an error. This page names 57 such traps.
This page makes no network requests at all.
The parsing and the signature check both happen inside your browser. Once loaded it works in aeroplane mode.
The token and the key you paste are never sent anywhere.
A token is a credential, so before pasting one into anybody else's page, get into the habit of
opening the Network tab and watching what that page actually does.
You can do exactly that here, right now.
Check the signature (optional)
The three parts
Header (how it was signed)
Payload (the claims)
Signature
Things worth knowing
Nothing to flag so far.
Self-check
What this page works out for itself
The base64url decoding is hand-written; the browser's atob is not used.
It follows section 5 of RFC 4648 (the url-safe alphabet) and the rule in RFC 7515 that the
= padding is not written. It also watches for leftover bits that are not zero.
When they are not, a different string decodes to the same bytes, which leaves room for
what was signed and what was read to drift apart.
The UTF-8 decoding is hand-written too.
Overlong sequences, surrogate code points and anything above U+10FFFF are each treated as errors.
The JSON reading is hand-written as well.JSON.parsewill not tell you that a name appeared twice; it keeps the last one
and drops the rest without a word. Which one wins differs between libraries, so it is worth naming.
Anything hand-written can be wrong. So every time the page loads it checks itself against the
browser's own atob, TextDecoder and JSON.parse,
and prints the result in the self-check panel.
Only the signature check uses the browser, through crypto.subtle.
Hand-writing cryptography would fail in the dangerous direction for a page whose job is to explain.
Neither the key nor the token leaves the page; crypto.subtle is a computation
inside the browser.
What it does not do, stated plainly.
An encrypted token (a JWE, the kind with five parts) is named as such and left closed.
That needs a key, and it is outside what this page is for.
The contents of an x5c certificate are not examined either.