safepaste jwt

JWT decoder

Paste a JSON Web Token to read its header and claims, decoded directly in this tab. The signature is shown, never verified, because checking one needs a key this page will never ask you for.

What happens to what you paste

Nothing. It is decoded in this browser tab and then it is gone when you close the tab. SafePaste has no account, no database and no analytics, so there is nothing for it to be stored in.

This is enforced, not promised

The page includes a Content Security Policy of connect-src 'none'. That makes fetch, XMLHttpRequest, WebSocket, EventSource and sendBeacon fail in the browser itself, whatever the code on this page tries to do. Images and fonts are restricted to data that is already inside the file, and form-action 'none' prevents all form submission.

You do not have to take our word for it. Open your browser's developer tools, watch the Network tab while you use the page, and confirm that it stays empty after the page itself has loaded.

What the host can see

This page is served by Cloudflare Pages. Like any web server, it sees the request for the page itself: an IP address, a user agent, a timestamp. That happens before any of this page's code runs and it is the same for every website you visit. What it does not see is anything you paste, because nothing you paste is ever part of a request. That includes the token itself: it is decoded entirely in this tab and its claims are never sent anywhere, which also means SafePaste has no way to check whether its signature is genuine.

No cookies, no storage, no trackers

The two links that leave

The footer links to Flytrap Industries and to a Stripe donation page. Neither is contacted unless you click it. They carry no query string and no referrer, so following one tells the destination nothing about what you were doing here. If you do donate, Stripe handles that payment under its own privacy policy and SafePaste never sees your card details.

Working offline

Save this page to disk and open it again. It is a single self-contained file, so it works with no network at all, including on a machine that has never been connected to one.

This policy describes the page you are reading. It is part of the same file, so the copy you save to disk carries it too.

How JWTs work

A JSON Web Token is three chunks of text glued together with dots: header.payload.signature. The header and payload are each just a JSON object, written in base64url so they are safe to put in a URL or an HTTP header. That is encoding, not encryption. Anyone holding the token, including this page, can read both of them without a password or a key.

The header says how it was signed

It is usually two fields: alg, the signing algorithm, and typ, almost always the literal string JWT. alg can legally be the string none, which means the token is not signed at all. A server that trusts a token's claims without checking that alg is one it actually expects can be handed a token nobody signed.

The payload carries the claims

Anything the issuer wanted to say: who the token is about, what they can do, and when. RFC 7519 names a handful of fields with a fixed meaning, which this page reads specially:

exp, nbf and iat are seconds since 1 January 1970, UTC. This page converts them into your own local time so you do not have to.

The signature is the part this page cannot check

Checking a signature proves the header and payload have not changed since whoever holds the signing key signed them. That is the entire security value of a JWT, and it needs the key: a shared secret for HS256 and its relatives, or a public key for RS256, ES256 and the rest. A page a stranger pasted a token into is exactly the last place that key should ever go, so this tool does not ask for one. It shows you the signature's raw bytes and nothing more. A token that decodes cleanly here has told you nothing about whether it is genuine.

If you need to actually verify a signature, do it with the library your server already uses to check tokens, using the same key it checks them against.