Drop in a JWT — by paste, Cmd/Ctrl+V, the clipboard
button, or by dragging a .txt/.jwt file.
It stays in this tab's memory; it is never sent anywhere, never
stored, never put in the URL.
tokenpeek splits the token on its dots and base64url-decodes the
header and payload right here in JavaScript. Standard claims
(exp, nbf, iat, …) are
rendered as human-readable times with a live expiry badge.
Paste the HMAC secret (HS256/384/512) or the public key as PEM or JWK (RS/PS/ES/EdDSA). The Web Crypto API verifies the signature in-browser and tells you pass or fail — and exactly why.
For HS256-family tokens, run the signature against a built-in weak-secret wordlist (and your own list) in a Web Worker. If the secret is guessable, tokenpeek finds it — locally, with a live throughput readout. Great for auditing your own APIs.
Edit the header/payload and re-sign to mint a test token, or generate a fresh RSA/EC keypair as PEM. Everything is produced by Web Crypto in your browser — copy or download, nothing uploads.
The offline alternative to "JWT decoder" websites. tokenpeek decodes, inspects, verifies, cracks weak secrets, and forges JSON Web Tokens — all in your browser, with zero backend and zero runtime dependencies.
Built because pasting a production access token into a random online decoder is a genuine security risk: that token may carry real credentials and PII. tokenpeek gives you the same workflow without ever letting a byte leave your machine.
Made by benrichardson.dev. Source on GitHub.
No cookies · no fingerprinting · no third-party fonts · works offline. Only analytics: anonymous, cookie-less page-view counts via Cloudflare Web Analytics.