Offline JWT Inspector
Decode, inspect, and verify JSON Web Tokens without sending your sensitive credentials to any remote server. Everything runs entirely in your browser memory.
Encoded Token
Signature Verification
Verify HMAC signatures (HS256, HS384, HS512) locally using the browser's native Web Crypto API.
⏱️ Token Validity & Lifetime
Decoded Header (algorithm & token type)
{
"alg": "none"
}Decoded Payload (data & claims)
{}Detected Standard Claims
| Claim | Standard Name | Value |
|---|---|---|
| No claims to display | ||
Frequently Asked Questions & JWT Security
🔒 Why inspect JWTs offline?
Most public JWT decoders transmit tokens over the network or log request bodies. If you paste a production user access token, session ID, or authorization bearer token into an online tool, you risk leaking sensitive user data and credentials. This tool runs 100% in your browser using the Web Crypto API, meaning nothing leaves your computer.
🧩 What are the three parts of a JWT?
A JSON Web Token consists of three base64url-encoded strings separated by dots:
1. Header: Identifies the algorithm (e.g. HS256, RS256) and token type.
2. Payload: Contains claims, user data, permissions, and timestamps.
3. Signature: Ensures the token has not been altered in transit.
📖 Common Registered Claims Reference
- iss: Issuer (who created the token)
- sub: Subject (e.g. user ID)
- aud: Audience (intended recipients)
- exp: Expiration time (UNIX epoch seconds)
- nbf: Not Before (not valid before this time)
- iat: Issued At (when the token was generated)
- jti: JWT Unique Identifier (for replay attack prevention)
🛡️ Can anyone decode my JWT?
Yes! A standard JWT is signed, not encrypted (unless using JWE - JSON Web Encryption). The payload is only base64url encoded, which anyone can decode. Never put unencrypted sensitive data like database passwords or private API keys inside a standard JWT payload.
I already have coffee; buy me an enduro bike instead 🏔️🚵♂️
