JWT Decoder
Decode JSON Web Tokens locally to inspect the header, payload, and expiry claims. Paste a JWT and read Base64URL-encoded fields without verifying signatures on a remote service. Ideal for debugging auth flows while keeping tokens off the network.
Runs in your browser. Nothing is uploaded.
About this tool
Decode a JSON Web Token into header, payload, and signature without sending the token to an identity provider. Claims such as exp, iat, and nbf are shown as ISO and local times. By default the banner reads 'Signature not verified' so a decoded token is never mistaken for an authenticated session.
How to use: paste a compact JWT (three Base64URL segments). Inspect claims in the payload pane. If you paste an HMAC secret, ToolBuddy can verify HS256, HS384, or HS512 locally with the Web Crypto API. RSA and ECDSA tokens can still be inspected; they cannot be verified here.
Example: an access token with exp in the past shows as expired in local time. A typo in the secret fails verification without uploading the token. Do not paste production refresh tokens into a hosted decoder when this tab will do.
Keep access tokens in this tab. We do not log JWTs because they never leave your browser. After load, decoding works offline.
Related Crypto tools
Hash Generator
Generate cryptographic hashes (SHA-256, SHA-1, MD5, and more) from text using Web Crypto in your browser. Create checksums for files-as-text, compare digests, and copy hex output. Hashing never leaves the tab, so test strings and secrets stay private.
HMAC Generator
Compute HMAC-SHA signatures in the browser for webhook secrets and API signing. Paste a message and a key, pick SHA-1 through SHA-512, and copy hex or Base64. Keys stay in the tab.
AES Encrypt
Encrypt and decrypt text with AES-256-GCM in the browser. A password is stretched with PBKDF2; output is Base64(salt + IV + ciphertext). Useful for sharing a short secret over a side channel you control. Keys never leave the tab.
Secret Redactor
Redact JWTs, AWS keys, GitHub tokens, private keys, bearer tokens, and emails in pasted logs. Replacement happens in the tab.