Bearer JWTs
What this is
RFC 6750 sends access tokens as Authorization: Bearer <jwt>. This decoder strips a leading Bearer prefix. Never put JWTs in query strings (referrer leaks) or localStorage on a site with XSS. Prefer memory or httpOnly cookies with CSRF controls.
FAQ
- Case of Bearer?
- The scheme is case-insensitive. This tool accepts Bearer and bearer.