JWT Decoder
Decode a JSON Web Token (JWT) into its header and payload (no signature verification — that needs the signing key).
Signature is shown but not verified — verification requires the algorithm's signing key. Treat decoded payloads from untrusted tokens with care.
Monitor this automatically
NetTests can run this check on a schedule, preserve historical results, compare changes over time, and alert you the moment something breaks.
Start monitoring free → See all monitoring productsFrequently Asked Questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe string used to transmit claims between parties. It has three Base64-encoded parts separated by dots: header.payload.signature. The header specifies the algorithm; the payload carries the claims (user ID, roles, expiry, etc.); the signature proves the token was issued by a trusted party.
Can this tool verify the signature?
No — signature verification requires the secret key (for Hash-based Message Authentication Code (HMAC) algorithms like HS256) or the public key (for Rivest-Shamir-Adleman (RSA)/Elliptic Curve (EC) algorithms like RS256). This tool only decodes the Base64 parts to make the claims readable. Never trust the payload claims without verifying the signature in your application code.
What are the standard JSON Web Token (JWT) claims?
- sub — subject (usually the user ID).
- iss — issuer (who created the token).
- aud — audience (intended recipient).
- exp — expiry time (Unix timestamp).
- iat — issued-at time.
- nbf — not-before time (token is invalid before this).
Is it safe to paste a real JWT here?
A JSON Web Token (JWT)'s payload is only Base64-encoded, not encrypted — anyone who can read the token can read its claims. However, you should still treat JWTs as secrets because a valid token grants access until it expires. When debugging, use a short-lived test token or redact the signature before pasting.
Network Tools
-
HTTP Request
Send HyperText Transfer Protocol (HTTP) requests with custom method, headers, body, and authentication — inspect the full response.
-
HTTP Request Timing
Load a Uniform Resource Locator (URL) in headless Chromium and stream every fetched resource with size and timing.
-
HTTP Quick Check
The simplest possible check: fetch the page, confirm it returns 2xx.
-
CORS Tester
Test any Uniform Resource Locator (URL) for Cross-Origin Resource Sharing (CORS) with a custom method, headers, and body — see exactly why a browser would allow or block the request.
-
Dead Link Checker
Crawl a website and find broken internal links — renders JavaScript (JS) pages with a headless browser.
-
IP Blacklist Check
Check an IPv4 address against 49 major Domain Name System (DNS) blacklists (Spamhaus, SORBS, Barracuda, SpamCop, etc.).
-
Network Path Monitor
Continuous traceroute with per-hop loss and Round-Trip Time (RTT) statistics.
-
Traceroute
Trace the path packets take to a destination host, hop by hop.
-
Ping Scanner
Ping many hosts in parallel and report which are alive.
-
Ping Host
Send Internet Control Message Protocol (ICMP) echo requests and report round-trip time (RTT) and packet loss.
-
IP Geolocation
Resolve a domain or Internet Protocol (IP) address to its city, country, Autonomous System Number (ASN)/org, and coordinates — with a map.
-
IPv4 ↔ IPv6
Convert IPv4 to/from IPv4-mapped IPv6 (::ffff:a.b.c.d).
-
MAC OUI Lookup
Look up a Media Access Control (MAC) address's first 3 octets in the IEEE Organizationally Unique Identifier (OUI) vendor database (curated subset).
Email / SMTP Diagnostics
-
Email Health
One-click domain scorecard — Blacklist, Mail Server, Web Server, and Domain Name System (DNS) checks graded Errors / Warnings / Passed, MXToolbox-style.
-
Email Records Check
Consolidated Mail Exchange (MX), Sender Policy Framework (SPF), Domain-based Message Authentication, Reporting & Conformance (DMARC), and DomainKeys Identified Mail (DKIM)-selector lookup for an email domain.
-
SPF Record Checker
Look up and validate a domain's Sender Policy Framework (SPF) Text (TXT) record.
-
Email Blacklist Check
Resolve a domain's Mail Exchange (MX) hosts to Internet Protocol (IP) addresses and check each against 49 IP blacklists plus the domain itself against 9 domain blacklists.
-
SMTP Banner Probe
Connect to a Simple Mail Transfer Protocol (SMTP) server, capture its banner + EHLO capabilities, and test STARTTLS.
Packet Generation & Testing
-
TCP/UDP Connection Tester
Check Transmission Control Protocol (TCP) port reachability; optionally send a payload and read the reply.
-
TLS Handshake Inspector
Inspect a server's Transport Layer Security (TLS) handshake: version, cipher, Application-Layer Protocol Negotiation (ALPN), full cert chain.
-
HTTP Availability Check
Probe a list of hostnames (max 16) for HyperText Transfer Protocol (HTTP) and HyperText Transfer Protocol Secure (HTTPS) availability.
-
HTTP Latency
Send N HyperText Transfer Protocol (HTTP) HEAD requests to a Uniform Resource Locator (URL) and report min/median/mean/max/stddev latency. From this server's vantage.
-
Path MTU Probe
Discover the path Maximum Transmission Unit (MTU) to a host by sending increasingly large pings with the Don't Fragment (DF) bit set (binary search).
IP & Subnet Utilities
Routing & BGP
TLS / SSL Auditing
-
TLS/SSL Quick Scan
Probe which Transport Layer Security (TLS) protocol versions a server accepts and show the cipher each negotiates.
-
TLS/SSL Deep Scan
Full chain validation, Online Certificate Status Protocol (OCSP) stapling, Signed Certificate Timestamp (SCT) count, and per-Transport Layer Security (TLS)-version cipher matrix.
-
TLS/SSL Certificate Expiration
Days remaining before a server's Transport Layer Security (TLS) certificate (and its full chain) expires.
-
Domain Certificate Audit
Search Certificate Transparency logs for every Secure Sockets Layer (SSL) certificate ever issued to a domain — reveals subdomains, issuers, and historical issuance.
HTTP/2 & WebSocket
-
HTTP/2 Probe
Negotiate HTTP/2 via Application-Layer Protocol Negotiation (ALPN) and decode the server's SETTINGS frame (window size, max streams, etc.).
-
WebSocket Probe
Send a WebSocket Upgrade handshake and verify the Sec-WebSocket-Accept response, subprotocols, and extensions.
-
HTTP/2 Stress Testerlogin
Benchmark HTTP/2 server performance — measure requests per second, latency distribution, and concurrent stream throughput under sustained load.
Encoding & Conversion
-
Hex ↔ Text
Convert UTF-8 text to a hex string, or parse a hex string back to text (separators :/.- ignored).
-
Binary ↔ Text
Convert UTF-8 text to 8-bit binary, or parse a binary string back to text.
-
Case Converter
Convert text between common casings: UPPER, lower, Title, snake_case, kebab-case, camelCase.
-
Number Base
Convert a number between decimal, binary, octal, and hexadecimal representations.
-
Unix Timestamp
Convert between Unix epoch seconds and International Organization for Standardization (ISO)/Request for Comments (RFC) datetime formats (Coordinated Universal Time (UTC)).
-
IPv4 ↔ Decimal
Convert between dotted IPv4 notation, 32-bit decimal, hex, and dotted binary.
-
JWT Decoder
Decode a JSON Web Token (JWT) into its header and payload (no signature verification — that needs the signing key).