ReqPad vs JWT & Base64 Decoder/Verifier

ReqPad is the API client that Postman should have built for mobile. Test REST, WebSocket, GraphQL, gRPC, MQTT, Socket.IO and MCP — with built-in AI — all from your iPhone, iPad, or Mac. No laptop. No desktop app. No compromises. — WHY DEVELOPERS SWITCH TO REQPAD: You're on the train and staging is down. You're in a meeting and someone asks "is that endpoint returning the right schema?" You're in bed at midnight and a webhook isn't firing. With ReqPad, the answer is always the same: open your phone, test it, fix it, move on. — 7 PROTOCOLS, ONE APP: Most mobile API tools only handle REST. ReqPad handles seven: • REST/HTTP — every method with full header, body, and auth control, plus Server-Sent Events streamed live; Send as a Browser for sites that only answer browsers • WebSocket — Real-time bidirectional messaging with live connection status • GraphQL — Query editor with syntax highlighting, variables, and subscription support • gRPC — Server reflection and .proto file support • MQTT — Connect to IoT brokers with QoS levels and topic subscriptions • Socket.IO — Test event-driven real-time communication • MCP — Connect to Model Context Protocol servers: call tools, read resources, run prompts ReqPad is the only mobile API client with gRPC and Socket.IO support. — REQPAD AI — AN API EXPERT ON EVERY SCREEN: • Explain any failure — a 4xx, a GraphQL error, a refused WebSocket or a gRPC status — with the cause and a one-tap fix • Describe a request in plain words — ReqPad AI fills in the method, URL, headers and body • Write messages and queries — GraphQL from your schema, WebSocket, Socket.IO and MQTT messages, gRPC messages from the proto, MCP tool arguments • Write tests for the response you just got • Ask the JSON a question — get a JSONPath filter You see exactly what is sent before it is sent, and secrets are removed on your device first. — SCRIPTS & AUTOMATION: • Pre-request and test scripts with the Postman-compatible pm.* API • Collection Runner — run whole collections with CSV/JSON data files and a report • OAuth 2.0 flows with automatic token refresh • Secret variables kept in secure storage • JSON tree view with JSONPath filtering — ENTERPRISE AUTHENTICATION BUILT IN: Don't hack together auth headers manually. ReqPad supports: • Bearer Token & JWT • OAuth 1.0 & 2.0 (full flow) • Basic & Digest Authentication • API Key — header, query param, or cookie • AWS Signature v4 • Hawk Authentication • Akamai EdgeGrid — GENERATE CODE IN 20+ LANGUAGES: Build your request visually, then export it as production-ready code: Swift, Kotlin, Python, JavaScript, Go, Rust, PHP, Ruby, C#, Java, Dart, cURL, and more. — IMPORT EVERYTHING, START IN SECONDS: • Postman Cloud Sync — Import your existing workspaces in one tap • cURL Import — Paste a cURL command and ReqPad builds the request • OpenAPI / Swagger — Import full API specs • HAR Files — Import browser network recordings • APIs.guru Directory — Browse and test 2,500+ public APIs instantly Already invested in Postman? You don't have to start over. Bring your work with you. — ORGANIZE LIKE A PRO: • Collections — Group requests into folders by project, team, or API • Environments — One tap to switch between dev, staging, and production • Variables — Use {{dynamic_variables}} in URLs, headers, and request bodies • History — Every request saved and searchable • Cookie Manager — Full visibility and control over stored cookies — YOUR DATA STAYS YOURS: ReqPad is privacy-first. Your API keys, tokens, and request data live on your device. We don't track your requests, log your endpoints, or store your credentials on our servers. ReqPad AI is optional and sends only what an action needs, after you see it. — Free to start. No account required. Just open and test. Questions or feature requests? We actually read every email: support@reqpad.app Terms of Use: https://reqpad.app/terms Privacy Policy: https://reqpad.app/privacy

JWT Decoder, Encoder & Verifier is the JSON Web Token companion your phone has been missing. Paste a token and instantly see its header, payload, and claims decoded - then verify its signature, sign your own, or convert Base64 back and forth. Everything runs on the device. No accounts, no network calls, nothing stored. 100% OFFLINE, NOTHING LEAVES YOUR DEVICE Tokens often carry sensitive data, so this app never uploads them. All parsing, verification, signing, and Base64 work happens locally. There is no server, no logging, and no analytics on the content you paste. It is the safe way to inspect a production token on your phone. DECODE - Live decoding as you type or paste - no "decode" button needed - Pretty-printed JSON for both the header and the payload - Time claims (iat, nbf, exp) shown as readable UTC, with EXPIRED and "not yet valid" badges - Raw Base64URL signature segment displayed separately - Clear, specific errors for malformed tokens VERIFY SIGNATURES - HMAC: HS256, HS384, HS512 with a shared secret (raw or Base64 key) - RSA: RS256, RS384, RS512 (RSASSA-PKCS1-v1.5) with a PEM public key - RSA-PSS: PS256, PS384, PS512 with a PEM public key - ECDSA: ES256, ES384, ES512 with a PEM public key - The input automatically switches between secret and PEM based on the token's algorithm, and the result clearly states valid, invalid, or why it could not be checked SIGN AND GENERATE - Build and HMAC-sign a JWT from any JSON payload (HS256/384/512) - One-tap "Generate key pair" creates a throwaway RSA or EC key for testing, fills the private key, and shows the public key to copy straight into the Verify tab - a complete sign-then-verify loop, entirely on device BASE64 TOOLBOX - Encode and decode standard Base64 and URL-safe Base64URL - Optional padding control - Falls back to a hex view when decoded bytes are not valid UTF-8 text BUILT FOR ENGINEERS - Paste straight from the system clipboard with one tap - Load a built-in example to see how each tool works - Copy any result to the clipboard - Monospace, selectable output throughout POLISHED TO MATCH YOUR PHONE - Native Material Design 3 interface - Light and dark themes that follow the system setting - Localized in English, Traditional Chinese, Simplified Chinese, and Japanese WHO IT IS FOR - Backend and mobile developers debugging auth tokens - Security engineers inspecting and verifying JWTs - QA and support teams checking expiry and claims - Anyone who needs to decode a token without pasting it into a website A note on standards: this tool reads and verifies tokens; it is an inspection and testing utility, not a secrets manager. Keys you paste or generate stay on the device and are never transmitted. JWT Decoder, Encoder & Verifier is fast, private, and made for real debugging. Install it once and stop pasting tokens into random web decoders.