JWT Decoder and Inspector
Decode a JWT and read its claims and expiry in your browser, the token never leaves the page.
- Runs in your browser, files never leave your device
- Free, open source, no account, no ads
- Works offline after the first visit
Decode a JSON Web Token
It decodes as you paste. Press Ctrl or ⌘ + V anywhere on the page. The token is never stored or sent anywhere.
Verify the signature
Your secret or key stays on this device. Your browser's built-in WebCrypto checks the signature, then the value is dropped from memory. It is never saved or sent.
How it works
- Paste a token. Use the button, press Ctrl or ⌘ + V, or type it in. Bearer prefixes, quotes and line breaks are removed for you.
- Read what is inside. The header, payload and signature appear in matching colors, with every claim explained and dates shown in your local time and in UTC.
- Verify if you need to. Open the verify panel and paste the shared secret or public key (PEM or JWK). WebCrypto checks it on this device.
Questions, answered
Is my token or secret sent anywhere?
No. JWT Decoder and Inspector runs entirely in your browser. The token is decoded with JavaScript on your device, the signature is checked with your browser's built-in WebCrypto, and nothing is sent to a server or written to local or session storage. You can disconnect from the internet and it keeps working. Even so, treat live production tokens like passwords.
Does decoding a JWT prove it is genuine?
No. Anyone can read the header and payload of a signed JWT, because they are only base64url encoded. Only a signature check with the right secret or public key shows the token was issued by who it says and was not changed. Use the verify panel for that; it supports HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384 and ES512.
Why does it say expired when my server still accepts the token?
The status uses your device clock. Servers often allow a minute or two of clock skew, and a wrong clock on either side shifts the result. If a date looks thousands of years away, the issuer probably wrote milliseconds instead of seconds, and the tool flags that.
Is it really free?
Yes. It is open source under the MIT license, with no account, no limits and no ads. If it saves you from pasting tokens into sites you do not trust, you can say thanks on Ko-fi.
Does it work offline?
Yes. After your first visit the page is cached by a service worker, so it loads without a connection. You can also install it from your browser's menu as an app.
Was this written by AI?
Yes. JWT Decoder and Inspector was generated by Claude Code from a written specification inside an automated pipeline, with a test suite that runs in a real browser. The full source is on GitHub, so you can read every line before you trust it with your tokens.
Built by one person, given away for free
JWT Decoder and Inspector is a free alternative to paid tools like jwt.io. If it earns a place in your bookmarks, a coffee keeps the updates coming.
☕ Support Or on Ko-fi