OneTaskBy Tim King · Updated
Bearer Token Decoder
Identify an API Key or JWT From an Authorization Header
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Bearer Token Decoder works
This bearer token decoder takes an Authorization header or a bare token and works out what it is. JWTs are decoded to show the issuer, subject, scopes and expiry, Basic credentials are split into username and password, and API keys are matched to their provider by prefix.
What the bearer token decoder recognises
The decoder strips the Authorization: name and the scheme, whether Bearer, Basic, Token or Bot. A token
with three dot-separated parts is a JWT and five parts is an encrypted JWE, whose header is shown but
whose payload cannot be read without the key. Basic credentials are only base64, so the username and
password are shown in clear with a warning.
Other tokens are checked against known prefixes such as sk_live_ for Stripe, AKIA for AWS, ghp_
for GitHub, xoxb- for Slack and sk-ant- for Anthropic. Opaque tokens get their length, character set
and an upper-bound entropy estimate. Everything runs in your browser, but any live credential pasted into
a page, chat or ticket should be rotated afterwards.
FAQ
Can I tell whether a token is still valid?
For a JWT, the exp claim shows when it expires, but only the issuer can say whether it has been revoked.
Opaque tokens and API keys carry no expiry you can read, so the only way to check is to call the
provider's API, which this page deliberately does not do.
Why does it say to rotate my token?
Tokens are passwords. Once one has been pasted outside the system that owns it, you cannot be sure where else it has been copied or logged. Rotating costs a minute in the provider's dashboard and removes the doubt, so the advice appears for every token.
What does the entropy figure mean?
It is the token length multiplied by the bits per character of its alphabet, which is the most randomness the token could hold. Real tokens often contain fixed prefixes or checksums, so the true figure is lower. Anything above about 128 bits is out of reach of guessing.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
JWT Decoder
Decode a JWT and read its claims and expiry.
Basic Auth Header Generator
Build or decode an HTTP Authorization Basic header.
JWT Signature Verifier
Verify a JWT's signature with a secret, PEM key or JWKS.
API Key Generator
Random prefixed API keys with an optional checksum, like GitHub tokens.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.