Secure, Offline JWT Decoder & Claim Inspector
Decode Base64URL header and payload claims, verify token expiration, and audit signatures locally. 100% private, zero-telemetry, and runs entirely in your browser.
Runs 100% in local memory using the browser's native window.crypto.subtle. Secret never touches any server.
Algorithm & Typ
Expiration Status
Token Age
{
"alg": "RS256",
"typ": "JWT",
"kid": "MTYxOTQzOTA4MzU3NDAyMzUyNzE0MzQ1NEE1MTVDNDI3MQ"
}{
"iss": "https://auth.jSonglow.com/",
"sub": "auth0|65f49102e1d654c89f012e48",
"aud": [
"https://api.jsonglow.com/v1",
"https://auth.jSonglow.com/userinfo"
],
"iat": 1737452800,
"exp": 2052772800,
"scope": "openid profile email read:data write:schemas",
"azp": "yyPfBsNyzrHArXdtaL49jGzzMcgMnXVh",
"email": "alex.dev@example.com",
"email_verified": true,
"name": "Alex Rivera",
"roles": [
"admin",
"developer"
]
}JSONGlow's JWT Decoder is a zero-telemetry, 100% offline browser utility that decodes Base64URL headers and payloads, calculates exact expiration countdowns, and verifies cryptographic signatures directly in client-side memory.
Privacy & Compliance
Why secure offline JWT decoding is essential for engineering teams.
JSON Web Tokens (JWTs) are the foundation of modern OAuth 2.0 and OpenID Connect (OIDC) authentication architectures. However, debugging production access tokens on public third-party websites poses a severe compliance and security vulnerability. Tokens frequently contain sensitive identity claims, enterprise email addresses, authorization roles, and session identifiers.
When developers paste live bearer tokens into server-backed web utilities, those tokens can be cached in proxy access logs, monitored by third-party telemetry scripts, or stored in server memory. This risks credential leakage and violates compliance frameworks including SOC2, HIPAA, and GDPR.
JSONGlow eliminates this risk through strict client-side execution. Base64URL parsing, multi-byte UTF-8 string decoding, expiration lifecycle checks, and HMAC/RSA signature validations execute exclusively inside your web browser's local sandbox using the standardized Web Crypto API.
No network packets containing your tokens are ever sent across the wire. You can audit live production tokens, test expired authentication flows, and inspect key IDs with complete confidence.
Workflow Guide
How to decode and verify JWTs offline in 3 steps
Input encoded JWT
Paste your compact JWS string (with or without `Bearer ` prefix) into the left editor pane. Input is processed exclusively in your browser's local RAM.
Verify expiry & payload
Review the color-coded token breakdown, active/expired lifecycle status, human-readable UTC/local timestamps, and detailed RFC 7519 claim definitions.
Optional Web Crypto audit
Optionally enter an HMAC secret (HS256/384/512) or RSA public key (RS256) to verify the token's cryptographic integrity in-browser using Web Crypto API.
Practical Demonstration
JWT Base64URL Decoding Example
See how an opaque compact JWS string is decomposed into structured JSON headers, identity claims, and expiration diagnostics.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiJ1c3JfOTk4MTQ0MiIsImlzcyI6Imh0dHBzOi8vYXBpLmpzb25nbG93LmNvbSIsIm5hbWUiOiJKb3JkYW4gU21pdGgiLCJyb2xlIjoiZW5naW5lZXIiLCJleHAiOjIwODI3MTUyMDAsImlhdCI6MTczNzQ1MjgwMH0.
1xLw6c6W7-2-8uVd1a6GgqN8jI0T3K2mNqFvT4yv8E8// HEADER: Algorithm & Token Type
{
"alg": "HS256",
"typ": "JWT"
}
// PAYLOAD: Data Claims & Timestamps
{
"sub": "usr_9981442",
"iss": "https://api.jsonglow.com",
"name": "Jordan Smith",
"role": "engineer",
"exp": 2082715200, // Expires in 30+ years (Active)
"iat": 1737452800 // Issued timestamp
}Authentication Pitfalls
Common JWT errors & security vulnerabilities
Token Expired (JWTExpired / exp check failed)
Why it happens: The `exp` timestamp in the payload is in the past relative to the current Unix time. Servers will reject requests with HTTP 401 Unauthorized.
The 'alg: none' Security Vulnerability
Why it happens: If a token specifies `"alg": "none"` in its header, it contains no cryptographic signature, allowing arbitrary payload tampering if the backend is misconfigured.
Invalid Compact JWS Format (Missing Dots)
Why it happens: A standard compact JWT must contain exactly 3 dot-separated Base64URL segments (`Header.Payload.Signature`). Encrypted JWE tokens have 5 parts.
Invalid Base64URL Padding or Characters
Why it happens: Standard Base64 uses `+`, `/`, and `=` padding, while Base64URL replaces them with `-` and `_` and strips padding. Non-standard characters cause decoding failure.
Core Capabilities
Comprehensive in-browser JWT debugging suite
Zero-Telemetry Privacy
Tokens are processed strictly in local browser memory. Zero server uploads, zero logging, zero telemetry.
Automatic Expiration Auditor
Evaluates `exp`, `iat`, and `nbf` timestamps with live active/expired badges and relative time countdowns.
In-Browser Web Crypto Verification
Audit HMAC (HS256/384/512) and RSA (RS256) signatures in-browser without sending keys to any remote API.
RFC 7519 Claims Dictionary
Explains standard claims (`iss`, `sub`, `aud`, `jti`, `azp`, `roles`, `scope`) with human-readable descriptions.
Color-Coded Segment Breakdown
Visualizes the compact JWS structure separating Header, Payload, and Signature with syntax coloring.
Offline & Air-Gapped Ready
Functions completely without an active internet connection for high-security environments.
Frequently Asked Questions
Common questions answered.
Need more help? Our tools execute entirely in your browser without transmitting any payload to remote servers.
Why is pasting production JWTs into online decoders a security risk?+
Many online JWT tools transmit pasted tokens to remote backend servers for parsing or log them in server access logs and analytics trackers. Because JWTs often contain confidential user IDs, email addresses, OAuth scopes, and active session credentials, sending them across the wire violates enterprise security policies (SOC2, HIPAA, GDPR) and risks credential theft. JSONGlow runs 100% locally in your browser, guaranteeing zero telemetry.
Does JSONGlow send my JWT or secret key to any server?+
No. All Base64URL decoding, JSON formatting, expiration timestamp calculations, and cryptographic signature checks are executed strictly in your web browser's local RAM. No network requests are made, no tracking scripts inspect your input, and nothing is stored in cookies or remote databases.
Can I verify JWT signatures without exposing my secret key?+
Yes. By using the browser's native Web Crypto API (`window.crypto.subtle`), HMAC-SHA256/384/512 and RSA signatures can be verified directly on your computer. Your secret key or public certificate is evaluated in memory and never leaves your device.
How does the decoder handle multi-byte UTF-8 characters and Unicode in payloads?+
JSONGlow uses native `TextDecoder` byte stream decoding rather than legacy `unescape(atob())` approaches. This ensures that international characters, emojis, and multi-byte UTF-8 strings in JWT payloads are rendered accurately without corruption.
What is the difference between JWT and JWE?+
A standard JWT (JWS) is signed and readable once Base64URL-decoded, meaning anyone with the token can inspect the header and payload claims. A JWE (JSON Web Encryption) consists of 5 segments and encrypts the payload so that only holders of the private decryption key can read its contents.
Does this tool work offline without an internet connection?+
Yes. Once the page is loaded, the entire tool functions without network connectivity. You can disconnect from Wi-Fi or run in airplane mode and continue decoding tokens with full confidence.
Explore More Tools & Guides