How to decode a JWT online without sending the token to a server

01Why the usual way fails

A JWT is only encoded, not encrypted, so anyone who gets a live token can often use it until it expires. Many tool sites send what you paste to their servers, and they rarely say so clearly. Writing your own decoder each time is slow, and doing it in a hurry during an incident leads to mistakes. Ads and slow, cluttered pages make the simple job of reading a token feel harder than it should be.

02How DevTools Hub helps

DevTools Hub is a set of free developer tools where nearly every tool runs in your browser. When you paste a JWT into the decoder, it is processed locally in JavaScript and never sent to a server, which also makes it fast. The JWT Toolkit has eight tools to decode, understand, verify, build and secure tokens in one place. The site was built out of frustration with cluttered tool pages, so the input box is easy to reach.

03Step by step

1. Open the JWT Toolkit on DevTools Hub.
2. Paste the token into the decoder; it is read in your browser, not on a server.
3. Check the header and claims, such as the issuer and the expiry time.
4. Use the verify tool when you need to confirm the token was signed with the key you expect.
5. Close the tab when you are done, and rotate the token if you think it was exposed elsewhere.

04Tips

• Treat every real token like a password. Even with a local decoder, avoid pasting live production tokens into shared screens or chat, and prefer expired or test tokens when you only need to check the format.
• Read the expiry and issued-at claims first. Most authorization errors come from a token that expired or was issued for a different audience.
• Keep related tools close. The same site has hashing, encoding and password tools that also run in the browser, which helps when you are debugging a whole auth flow.
• Check the privacy policy of any tool you rely on during incidents. DevTools Hub points to its Privacy Policy for the details of what is processed locally.

05Questions