JWT

Umbra's JWT tool decodes a token's header and payload entirely offline — it never sends the token anywhere, and it doesn't verify signatures.

Paste a token to see its header and payload laid out clearly, with expiry and issued-at claims translated into plain language (“expires in 3 days,” not a raw timestamp). It reads the token; it doesn't check whether it's genuine — stated plainly in the tool itself.

FAQ

• Why not decode a JWT with a free online tool?

  A JWT often carries real session or identity data — Umbra decodes entirely on your machine and never transmits it.

• Does it verify the signature?

  No, and it says so — verifying requires the signing key, which this tool never asks for.

• Can it warn me if a token isn't signed?

  Yes — Umbra flags a token as unsigned or using an unreadable algorithm, which means anyone could have created or altered it, before you read anything else on the page.