Free tool · Runs in your browser
Decode a JWT
without leaving your browser tab
Paste a JWT, see its header and payload as readable JSON — expiry converted to a real date, nothing sent to a server.
Token
Decoding happens entirely in your browser. The token never leaves this page — nothing is sent anywhere, logged, or stored.
Why a bearer token is worth actually reading
Debugging a 401
Half of “unauthorized” bugs are an expired or wrong-audience token, not a broken auth check. Decoding the token you're actually sending settles it in seconds.
Checking scope, not just identity
A valid token can still be the wrong token — issued for a different org, a different audience, or missing the scope an endpoint requires.
Understanding an API's contract
The claims a service puts in its tokens (org_id, scopes, session vs. API-key origin) tell you a lot about how it models auth before you read a line of docs.
Never trust decode as verify
Anyone can decode a JWT — that's by design, it's not encrypted. Only signature verification (server-side, with the real key) proves it wasn't altered.
Questions, answered honestly
Does this verify the signature?
No. Verifying a signature requires the secret or public key the issuer signed it with, which never leaves the issuer's server. This tool decodes the header and payload — the parts anyone holding the token can already read — and is upfront about not vouching for authenticity.
Is it safe to paste a real token in here?
Nowhere. Decoding is pure client-side JavaScript (base64url decode + JSON.parse) that runs entirely in your browser tab. The token in the box never leaves your machine — that's true even for a real production API key or session token, though we'd still suggest using a scratch token when possible.
What are the three parts of a JWT?
A JWT is three base64url-encoded segments joined by dots: a header (algorithm + token type), a payload (the claims — who, what org, what scopes, when it expires), and a signature (proof it wasn't tampered with, checkable only with the signing key).
What do exp, iat and sub mean?
exp (expiration, Unix seconds), iat (issued-at), nbf (not-before), sub (subject — usually a user ID), aud (audience — who the token is for), iss (issuer). This tool converts exp/iat/nbf to readable dates automatically.
Where do Norbelys API tokens fit in?
It calls the API generated from Norbelys's oRPC contract — the same contract that drives the CLI and the MCP server — using a Clerk-issued bearer JWT (browser) or an org-scoped ak_ API key (headless). Decoding one here is a quick way to see exactly what's inside a token you're debugging.
Building on top of Norbelys?
Norbelys's CLI, MCP server and typed SDKs all run on the same oRPC contract and the same bearer-token auth — one door, checked once, never drifting between surfaces.
Start sendingFrom $29/mo · Cancel anytime