ToolbitJWT Decoder and Token Inspector
Paste a JSON Web Token and read its header and claims immediately, with issued-at and expiry timestamps rendered as human dates. Because decoding is local, you can safely inspect a real access token.
What the JWT Decoder does
- Header and payload decoded and pretty-printed side by side.
- iat, nbf, and exp shown as readable dates with an expiry warning.
- Algorithm and key id surfaced from the header.
- Signature segment displayed without ever being transmitted.
How to use it
- Paste the JWT — all three dot-separated segments.
- Read the decoded header and claims.
- Check the expiry banner to see whether the token is still valid.
Why it runs locally
Toolbit has no backend. The JWT Decoder is implemented with standard browser APIs, so your input is processed in the tab and never uploaded, logged, or retained. That is what makes it safe to paste real data into — and it is also why the tool keeps working with the network disconnected, once you have installed Toolbit as an app.
Frequently asked questions
- Is it safe to paste a real access token?
- Yes, safer than most alternatives: decoding happens entirely in your browser and the token is never sent anywhere. It is still good practice to use a short-lived or test token where you can.
- Can it verify the signature?
- The decoder reads the token; verifying the signature requires the issuer's secret or public key, which should stay in your backend.
- Why is my payload not readable?
- Encrypted tokens (JWE) have five segments rather than three and cannot be read without the decryption key. Signed tokens (JWS) decode fine.