Decode any JSON Web Token in a second — paste it in and JWTPeek splits it into a colour-coded header, payload and signature, pretty-printed and ready to copy. It is the fast, private way to read and inspect a JWT without pasting it into a random website.
Most online JWT decoders make you send a sensitive bearer token to a server. JWTPeek does everything locally with Apple's CryptoKit — your token is decoded and verified right on your iPhone and never touches a server, a log or the network.
WHAT YOU GET
- A clean three-part breakdown of any token: header, payload and signature, each Base64URL-decoded and pretty-printed
- Copy the header or payload segment to the clipboard with a single tap
- Every claim laid out and labelled — registered claims (iss, sub, aud, exp, nbf, iat, jti) and your own custom claims
- exp, nbf and iat shown as real human dates, with a live expiry countdown and a clear valid, expired or not-yet-valid status
- One-tap HMAC signature verification with HS256, HS384 or HS512 — enter your secret as plain text or Base64 and see match or mismatch
- Clear alg:none warnings so you never trust an unsigned token by mistake, plus a notice that asymmetric RS, ES and PS algorithms are not verified
- A saved history of recently decoded tokens, on this device, so you can reopen any of them in a single tap
- A built-in JWT reference so you can brush up on the standard as you work
- Optional auto-decode from the clipboard, a one-tap sample token, and an opt-in daily local reminder to keep the habit
PERFECT FOR
- Backend and API developers debugging authentication and login flows
- Engineers building with OAuth 2.0 and OpenID Connect
- QA and security testers inspecting bearer tokens and claims
- Anyone who needs to quickly check when a token expires
WHY NOT JUST USE A WEBSITE?
Because pasting a real access token into a browser tab sends it over the internet to a third party. A JWT is a bearer credential — whoever holds it can use it. JWTPeek keeps every token on your device, so you can inspect production tokens without leaking them.
PRIVACY
100% on-device. Every token is decoded and verified locally with CryptoKit. Nothing is ever uploaded, logged, or sent to any server. There are no accounts and no tracking.
FULL ACCESS
JWTPeek Premium unlocks the full toolkit: on-device HMAC signature verification (HS256, HS384, HS512) and the complete security reference. Choose the plan that fits you:
- Weekly — auto-renews every week
- Yearly (best value) — auto-renews every year
- Lifetime — pay once, yours forever
Weekly and Yearly subscriptions auto-renew until cancelled; Lifetime is a single one-time purchase. You can restore purchases at any time.
Paste your first token and see it decoded in seconds.
Terms of Use (EULA): https://web-levi.web.app/terms
Privacy Policy: https://web-levi.web.app/privacy-policy
Questions? tphuc.work@gmail.com
