JWT decoder
Read the header and claims, check expiry, verify HS, RS, and ES signatures, and sign with a shared secret.
/tools · 7 tools
The small jobs that usually mean a tab on someone else's site: decode a token, tidy JSON, convert a timestamp, hash a file. Each one runs in this page. Nothing you paste is sent anywhere.
/all
Client-side only, built on the browser's own WebCrypto, URL, and Intl APIs. The source ships in the site repository like everything else CAVI publishes.
Read the header and claims, check expiry, verify HS, RS, and ES signatures, and sign with a shared secret.
Pretty-print with 2, 4, or tab indentation, minify, sort keys, and see the line and column of the first error.
Text or files in, standard or URL-safe alphabet out, with padding optional. Decodes either alphabet.
Percent-encode a component, a whole URL, or a form value, decode either, and break a URL into its parts.
Unix seconds, milliseconds, ISO 8601, RFC 7231, ISO week, and any IANA time zone from one input.
Random v4 or time-ordered v7 in bulk, upper or lower case, with or without dashes. Inspect any UUID.
Digest text or a file with every SHA variant at once, as hex or Base64, optionally keyed as an HMAC.