JWT Decoder - JSON Web Tokens

1.0.0

Tahatec

0.00

0 reviews

1+
Downloads

Free

Decode, inspect and verify JSON Web Tokens (JWT). Nothing leaves your phone.

JWT Decoder - JSON Web Tokens Screenshot 1 of 9

JWT Decoder - JSON Web Tokens Screenshot 2 of 9

JWT Decoder - JSON Web Tokens Screenshot 3 of 9

JWT Decoder - JSON Web Tokens Screenshot 4 of 9

JWT Decoder - JSON Web Tokens Screenshot 5 of 9

JWT Decoder - JSON Web Tokens Screenshot 6 of 9

JWT Decoder - JSON Web Tokens Screenshot 7 of 9

JWT Decoder - JSON Web Tokens Screenshot 8 of 9

JWT Decoder - JSON Web Tokens Screenshot 9 of 9

Download from Google Play

About JWT Decoder - JSON Web Tokens

JWT Decoder - JSON Web Tokens is a tools app developed by Tahatec.

Download Statistics

JWT Decoder - JSON Web Tokens has been downloaded 2 times. In the last 30 days, the app was downloaded 2 times.

User Ratings

The app has no ratings yet.

App Information

JWT Decoder - JSON Web Tokens is FREE to download. The APK download size is 25.21 MB. The latest version available is 1.0.0. The last update was on August 24, 2026.

Technical Requirements

The app has a content rating of Everyone. The app has been available on Google Play 2 weeks ago.

Description

A JSON Web Token is a credential. This app decodes one, explains what it says,
and checks its signature — entirely on your device, with no network access of
its own.

DECODE ANYTHING TOKEN-SHAPED

Paste a token, or send one here from another app: select it in a log, a curl
command, an Authorization header or a JSON response, then use Share or the
Decode JWT item in the text menu. The token is pulled out of the text around
it.

Signed tokens (JWS) and encrypted ones (JWE) are both recognised. A JWE's
claims cannot be read without the recipient's private key, so the app says so
and shows what the protected header does reveal, instead of calling a valid
token broken.

When a token is damaged you still get what could be read: a truncated payload
does not stop the header naming the algorithm and the key id.

READ THE CLAIMS, NOT THE BASE64

Every registered claim is named and explained: issuer, subject, audience,
expiry, not-before, issued-at, token id. Time claims show as a real date plus
how far off — "expired 4 hours ago", "in 12 minutes" — in local time, UTC or raw
seconds.

Audience works whether it is a single string or a list. Around ninety claim
names are recognised, including the OpenID Connect set and the vendor ones from
Microsoft Entra, Firebase, AWS Cognito, Auth0 and Keycloak, so you can tell
which system minted the token.

CHECK THE SIGNATURE

• HS256, HS384, HS512 against a shared secret — as text, base64, base64url or
hex, which you choose rather than the app guessing
• RS256/384/512, PS256/384/512, ES256/384/512 and ES256K against a public key
• Keys accepted as a PEM, an X.509 certificate, a JWK, or an entire jwks.json —
in which case the token's own key id picks the right entry

The verdict is never just yes or no. "Does not match", "wrong kind of key",
"wrong curve" and "this algorithm cannot be checked here" are four different
answers, and you get the true one. A signature that verifies but is DER-encoded
rather than the raw form JOSE wants is reported as exactly that: valid, and
still going to be rejected elsewhere.

KNOW WHAT IS WRONG WITH IT

Thirty-five findings, each explained in a sentence rather than named in jargon:

• "alg" set to none, so anyone can mint the token
• an algorithm name whose capitalisation does not match any registered one
• a key embedded in the header, or a header pointing at a remote key
• a "crit" extension a verifier is required to understand and does not
• "nbf" at or after "exp", so there is no moment the token is ever valid
• "exp" emitted in milliseconds — or microseconds, or nanoseconds
• the same claim appearing twice, which different libraries resolve differently
• no audience, so nothing binds the token to the service receiving it
• an ECDSA signature of the wrong length for its curve
• and the one a lot of people need to hear: the payload is signed, not
encrypted. Anyone holding the token can read every claim in it.

BUILT FOR SOMETHING YOU DO NOT TRUST

No token, key or secret is ever transmitted, and keys and secrets are never
written to storage at all — they exist only while the screen is open.

Recent tokens are kept on the device so you can return to them. The list shows a
masked token and asks before revealing one; the store is capped and clearable,
and it is excluded from Android's cloud backup and device-to-device transfer, so
a stored token never leaves the phone. Switching the feature off deletes what is
already there.

ALSO

• Light and dark, following your system setting
• Ten languages
• Syntax-coloured payload and header, numbers shown exactly as written
• A configurable clock-skew allowance, so the verdict matches what a server
with a slightly different clock would decide
• Nested tokens: if the payload is itself a JWT, open it

Recent changes:
Decode any JWT or JWE, read its claims in plain language, and check the
signature on your own device — HS256/384/512, RS, PS and ES, against a PEM,
a certificate, a JWK or a whole JWKS.

Reports 35 things worth knowing about a token, from "alg" being none to an
"exp" emitted in milliseconds.

Share a token in from any other app. Ten languages. No network, ever.

Show more Show less

More data about JWT Decoder - JSON Web Tokens

Price	Free to download
Total downloads	2
Recent downloads	2
Rating	No ratings
Ranking	Not ranked
Version	1.0.0
APK size	25.2 MB
Number of libraries	?
Suitable for	Everyone
Ads	Contains ads

App Performance Report

Get a detailed PDF report for JWT Decoder - JSON Web Tokens with download trends, rating history, and key performance statistics — useful for competitive research or tracking your own app. Learn more

Get PDF Report — $29

Alternative downloads for the JWT Decoder - JSON Web Tokens app

JWT Decoder - JSON Web Tokens compared with similar apps

Common keywords of similar apps

Key Header Jwt Signature Read Json Decode Claims Payload Claim Wrong Web Text Valid Algorithm Id Audience Exp Leaves Network Share Signed Encrypted Jwe Recognised Shows Registered Named Explained Raw List Set System Check Secret Keys Pem Certificate Jwk Verdict Match Curve Alg Emitted Token Tokens App Device Phone Time

Keywords missing from this app

Mobile Authentication Security Authenticator Digital Secure Identity Factor Application Accounts Recent Qr Code Surepassid Authy Data Multi Account Activation Qlola Access Hardware Otp Click Website Banking Features Phishing Citibusiness Bug Solution Transactions Password Mfa Smart Codes Authpoint Mandiri Activate Verification Process Login Future Fixes

Changelog of JWT Decoder - JSON Web Tokens

Show changelog

Developer information for Tahatec

Tahatec

tahatec@yahoo.com

Website

Legal name:

Address:

Are you the developer of this app? Join us for free to see more information about your app and learn how we can help you promote and earn money with your app.

I'm the developer of this app

Comments on JWT Decoder - JSON Web Tokens for Android

We don't have enough comments to show example comments. Please check back later.

Google Play Rankings for JWT Decoder - JSON Web Tokens

This app is not ranked

Technologies used by JWT Decoder - JSON Web Tokens

14 permissions

Subscribe to see full permission and library details

AppBrain is a directory focused on discovering great apps and games. We give statistics, rankings and search options that Google Play and the App Store don't have. All trademarks are owned by their respective owners. AppBrain doesn't offer APKs or binaries, and always lets users install the official version from Google Play or the App Store.

More apps