JWT Decoder & Debugger - No Key Upload, Private Local Tool

Decode and debug JWTs in your browserโ€”no secret key, no uploads. Inspect header/payload, pretty-print JSON, and see a live exp countdown. Paste offline now.

Header
{}
Payload
{}

How to Use

  1. Paste your JWT (often starts with ey...) into the input.
  2. The tool decodes header and payload and formats them as JSON.
  3. Review status: active / expired / not-yet-valid.
  4. Copy the decoded JSON to share internally or debug safely.

Core Features

  • Client-side Decoding: Decode JWTs locally with zero key upload and zero server calls.
  • Expiration Countdown: Calculate remaining time from the exp claim with a live countdown.
  • Visual Payload Inspector: Inspect claims clearly to debug roles, audience, issuer, and scopes.
  • JSON Pretty Print: Beautify header and payload automatically for fast troubleshooting.
  • Keep data private: Tokens stay in memory on your device.

Related Tools

JWT Generator | Securely Create & Sign Tokens Offline

Generate and sign JWTs for API testing. Edit header and payload, use HS256/HS384/HS512, and keep your secret local while HMAC signing runs in the browser.
Strong Password Generator - XKCD Passphrases & Entropy Tool

Strong password generator for random passwords or XKCD passphrases. See entropy and crack-time estimatesโ€”secure, client-side only. Generate yours now.
Password Strength Checker | Local Crack Time Test

Test password strength and estimated crack time with zxcvbn. The check runs locally in your browser, so your input is not uploaded.
SSH Key Generator โ€“ Ed25519 & RSA in Your Browser

Generate Ed25519, RSA-2048, or RSA-4096 SSH keys with browser Web Crypto. Copy an OpenSSH public key and download the private key as PKCS#8 PEM.
Bcrypt Hash Generator & Checker

Generate Bcrypt hashes locally and verify passwords against existing hashes with adjustable Cost/Rounds for auth development, migrations, and seed data.
Hash Generator - Local SHA-256 & Checksum Tool

Generate SHA-256, SHA-384, SHA-512 hashes and file checksums locally in your browser. Compare expected values, copy results, and verify files without uploads.

Calculation Logic

  • A JWT is header.payload.signature.
  • We Base64Url-decode the first two parts and JSON.parse them for inspection.
  • We do not verify the signature (verification requires a secret/public key), so readable does not mean trusted.

FAQ

Is it safe to paste my JWT here?

Yes. We never ask for your secret key, and decoding runs 100% in your browser with no uploads.

How to check when a JWT expires?

We read the exp claim and compute the remaining time from now, showing a live countdown.

Is my data safe (local/privacy)?

Yes. Tokens are processed locally and are not sent, stored, or logged by a server.

Is it free? Any limits?

Itโ€™s free. For security, avoid pasting production tokens on shared/public devices.

Can I verify a JWT without a key?

No. Signature verification requires the correct secret/public key. This tool is for decoding and debugging claims only.