RunOfflineTools Logo RunOfflineTools
🔒 High-Trust Developer Security

Offline JWT Debugger & Inspector

Inspect JSON Web Tokens (JWT) completely client-side in browser memory. Decode headers, payload data, and human-readable expiration timestamps with zero server uploads.

🔒 100% Offline & Private: Token decoding is processed entirely in browser memory. No credentials are transmitted.
Encoded JWT Token
Token Segments:
Header (Algorithm & Token Type)
Payload (Claims & Data)
Signature (Verification hash)
Header: Algorithm & Token Typealg: HS256
{
  "alg": "HS256",
  "typ": "JWT"
}
Payload: Data Claims (8)
{
  "sub": "usr_0a1b2c3d4e",
  "name": "Alex Rivera",
  "email": "alex.rivera@example.com",
  "roles": [
    "admin",
    "developer"
  ],
  "iat": 1709820000,
  "exp": 1784448000,
  "iss": "auth.example.com",
  "aud": "api.example.com"
}

🕒 Decoded Timestamp Claims

exp (Expiration Time): Sun, 19 Jul 2026 08:00:00 GMT (19/7/2026, 1:30:00 pm)
Expired 44d ago
iat (Issued At): Thu, 07 Mar 2024 14:00:00 GMT (7/3/2024, 7:30:00 pm)
Issued 908d ago

Why Privacy-First JWT Debugging is Essential

JSON Web Tokens (JWTs) carry sensitive authentication credentials, user roles, email addresses, and session identifiers. Pasting production auth tokens into cloud-based debuggers risks leaking access to unauthorized third parties.

Our Offline JWT Debugger executes 100% locally in your browser using standard Base64Url decoding algorithms, guaranteeing your tokens remain completely private.

Decoded Token Components

Frequently Asked Questions

Is it safe to decode production JWTs and auth tokens in this tool?

Yes, 100% safe. All token decoding happens strictly in your local browser JavaScript runtime. No tokens, secrets, or authorization claims are ever sent to any remote server or logged.

What information does the JWT Debugger display?

It breaks down the three components of a JSON Web Token: the Header (signing algorithm & type), the Payload (user claims, subject ID, roles, issuer, audience), and provides human-readable dates for exp (Expiration), iat (Issued At), and nbf (Not Before) timestamps.

Can I inspect expired JWT tokens and calculate elapsed time?

Yes! The debugger automatically checks the 'exp' claim and calculates relative expiration countdowns, highlighting expired tokens in red with exact elapsed time and active tokens in green.

What is the difference between HS256, RS256, and ES256 signing algorithms?

HS256 (HMAC with SHA-256) is a symmetric algorithm where the same secret key signs and verifies the token. RS256 (RSA Signature with SHA-256) and ES256 (ECDSA) are asymmetric algorithms using a private key to sign and a public key to verify (common in Auth0, Okta, and OpenID Connect).

What are common JWT claims like sub, iss, aud, and jti?

'sub' identifies the user subject ID; 'iss' identifies the token issuer (e.g. auth.example.com); 'aud' represents the recipient audience (API endpoint); 'jti' is a unique JWT identifier for preventing token replay attacks; 'iat' is the timestamp when the token was issued; and 'exp' defines the expiration timestamp.

Why should developers avoid online server-side JWT decoders?

Server-side JWT decoders can log production access tokens, session keys, and sensitive user emails into remote access logs or analytics databases. Using a 100% client-side offline debugger prevents accidental token leaks.