Decode JWT Tokens Without Uploading Them
JSON Web Tokens (JWT) often contain sensitive user IDs, scopes, roles, issuer, audience, expiration timestamps, and authentication metadata. Tool127 decodes the token locally in your browser, ensuring your data never leaves your device.
JWT Header vs Payload vs Signature
- Header: Contains metadata like the algorithm (e.g. HS256, RS256) and token type.
- Payload: Contains the actual claims such as subject (sub), issuer (iss), audience (aud), expiration (exp), and issued at (iat).
- Signature: The cryptographic verification data used to ensure the token has not been tampered with.
Common JWT Debugging Cases
- Check if a token is expired
- Verify issuer and audience match expectations
- Inspect OAuth/OIDC claims
- Understand granted scopes and roles
- Remove the Bearer prefix from copied Authorization headers
JWT Security Notes
- JWT payload is Base64Url encoded, not encrypted. Anyone can read the payload.
- Never store passwords, raw API keys, or secrets inside JWT payloads.
- Client-side expiration badges are useful for debugging, but your server must always verify the signature, issuer, audience, expiry, and algorithm.
Frequently Asked Questions
1. Is my JWT uploaded to a server?
No. The decoding runs entirely in your browser using JavaScript. Your token is never sent to our servers.
2. Can this tool verify JWT signatures?
You can verify the signature if you provide the secret key or public key. This verification also runs locally.
3. What does `exp` mean in a JWT?
`exp` is the expiration time claim. It is a numeric value representing the Unix time after which the JWT must not be accepted.
4. Is a JWT encrypted?
By default, no. A standard JWT (JWS) is only encoded and signed. Anyone with the token can decode and read the payload. For encrypted tokens, JWE (JSON Web Encryption) is used.
5. Is it safe to paste production tokens?
Since the tool operates 100% locally, it is generally safe. However, as a best practice, you should minimize copying and pasting production tokens with active sessions.
6. What is the difference between HS256 and RS256?
HS256 uses a symmetric shared secret for both signing and verifying. RS256 uses an asymmetric key pair: a private key to sign and a public key to verify.