A Bearer token in a HAR file is not something you paste into a random decoder. JwtShift decodes JWT header and payload in the browser and never sends the token to a server. Use it to read alg, kid, sub, exp, and custom claims when debugging auth. Do not use it as a signer, a cracker, or a place to verify signatures with a private key you paste. Decode is not verify. An altered payload still 'decodes.' Check exp with EpochShift. Treat access tokens as passwords: local decode, then close the tab, then rotate if it leaked into the HAR.
Paste the three base64url segments. See JSON header and payload. Signature is shown as opaque; this booth does not verify it against a JWKS. If the token is not three parts, it is not a JWT (maybe opaque, maybe a session cookie). Header alg=none is a museum piece you should not accept in production. Payload PII is still PII on your screen.
When not to use it: you needed to mint a token, to brute-force a weak secret, or to 'fix' a signature. Also skip encrypted JWE if the UI is a JWT decoder; you will see noise. Base64Shift can unwrap a single segment if you are teaching yourself the encoding. HashShift will not help you forge a signature.
Privacy is the product. Tokens in server-side decoders become logs. Here they stay in RAM. Still: browser extensions, screen shares, and support tickets leak. Redact. If you pasted a live token, revoke it. The tool cannot do that for you. JWE encrypted tokens will look like noise; this booth is JWT header and payload JSON, not a decryptor.
A staging access token pastes in. Header: alg RS256, kid abc. Payload: sub=user_18, exp=1735689600, scope=read:orders. EpochShift shows exp in UTC. You see the token is already expired, which is why the API said 401 — not a signature mystery. You never uploaded the JWT. You still delete the HAR because it contains other cookies. Expired exp explaining a 401 is the usual win versus a signature mystery that was never mysterious.
JwtShift decodes locally and never sends tokens. That is the entire privacy path. Treat the paste box like a password field. Close the tab, clear the HAR, rotate if the token was real. There is no server log of claims.
Full policy: Shift Privacy Policy. Questions: [email protected].
No. Anyone can decode a JWT payload. Validity is signature plus exp plus audience, checked by the resource server. This tool is a flashlight. Anyone can decode a payload; validity is signature plus exp plus audience on the resource server.
Do not paste production HMAC secrets into a web page, including this one. Verify in your app. Decode is the supported job. Pasting production secrets into a decoder, including this one, is how secrets become screenshots.
It may be JWE, not JWT, or not base64url. Opaque access tokens are random strings. There is nothing to decode. JWE is encrypted; opaque tokens are random; neither is a three-segment JWT waiting to become JSON.
The signature is MAC or public-key bytes, not a file checksum. HashShift will not tell you if the JWT is authentic. The signature is MAC or public-key bytes; HashShift will not tell you whether the JWT is authentic.
Related tools: Base64Shift · JsonShift · EpochShift
Guides · All Shift tools · About · Contact