Bearer Token Decoder
Paste an Authorization: Bearer header and decode the token inside it, or learn why it can't be decoded. Free and private: runs in your browser.
Copy the Authorization header from your browser's network tab or Postman and paste it as-is.
Hashing runs locally in your browser. Your input never leaves this page.
Use cases
- Debug a 401 by checking a token's expiry, audience and issuer.
- Inspect the claims your identity provider actually sends.
- Create test tokens for local API development.
Frequently asked questions
Why can't my bearer token be decoded?
Not every bearer token is a JWT. Opaque tokens are random strings that the server looks up, so they contain no readable data.
Is the Bearer Token Decoder free?
Yes. It is free with no sign-up, and it runs entirely in your browser, so your input is never uploaded or stored.
Is hashing the same as encryption?
No. A hash is one-way: you cannot get the input back. Encryption is reversible with a key. Use slow password hashes (bcrypt, Argon2, PBKDF2) for passwords and fast hashes (SHA-256) for integrity checks.
Related tools
Checking one snippet is a start. Scan your whole repository for free with CodeInspector.