# JWT Decoder

> Decode JSON Web Tokens locally to inspect the header, payload, and expiry claims. Paste a JWT and read Base64URL-encoded fields without verifying signatures on a remote service. Ideal for debugging auth flows while keeping tokens off the network.

Runs in your browser. Nothing is uploaded.

[Crypto](https://toolbuddy.dev/categories/crypto.md)

## About this tool

Decode a JSON Web Token into header, payload, and signature without sending the token to an identity provider. Claims such as exp, iat, and nbf are shown as ISO and local times. By default the banner reads 'Signature not verified' so a decoded token is never mistaken for an authenticated session.

How to use: paste a compact JWT (three Base64URL segments). Inspect claims in the payload pane. If you paste an HMAC secret, ToolBuddy can verify HS256, HS384, or HS512 locally with the Web Crypto API. RSA and ECDSA tokens can still be inspected; they cannot be verified here.

Example: an access token with exp in the past shows as expired in local time. A typo in the secret fails verification without uploading the token. Do not paste production refresh tokens into a hosted decoder when this tab will do.

Keep access tokens in this tab. We do not log JWTs because they never leave your browser. After load, decoding works offline.

## Related Crypto tools

- [Hash Generator](https://toolbuddy.dev/tools/hash-generator.md): Generate cryptographic hashes (SHA-256, SHA-1, MD5, and more) from text using Web Crypto in your browser. Create checksums for files-as-text, compare digests, and copy hex output. Hashing never leaves the tab, so test strings and secrets stay private.
- [HMAC Generator](https://toolbuddy.dev/tools/hmac-generator.md): Compute HMAC-SHA signatures in the browser for webhook secrets and API signing. Paste a message and a key, pick SHA-1 through SHA-512, and copy hex or Base64. Keys stay in the tab.
- [JWT Encoder](https://toolbuddy.dev/tools/jwt-encoder.md): Sign a JSON object into a compact HS256, HS384, or HS512 JSON Web Token in the browser. The HMAC secret stays in the tab, so you can mint a test token without posting it to a hosted encoder.
- [AES Encrypt](https://toolbuddy.dev/tools/aes-encrypt.md): Encrypt and decrypt text with AES-256-GCM in the browser. A password is stretched with PBKDF2; output is Base64(salt + IV + ciphertext). Useful for sharing a short secret over a side channel you control. Keys never leave the tab.
- [TOTP Generator](https://toolbuddy.dev/tools/totp-generator.md): Compute a time-based one-time password from a Base32 secret with HMAC-SHA, the same algorithm authenticator apps use (RFC 6238). Pick SHA-1, SHA-256, or SHA-512, 6 or 8 digits, and a 30- or 60-second step. The secret stays in the tab.
- [Secret Redactor](https://toolbuddy.dev/tools/secret-redactor.md): Redact JWTs, AWS keys, GitHub tokens, private keys, bearer tokens, and emails in pasted logs. Replacement happens in the tab.