Offline JWT Decoder & Token Expiry Inspector
Inspect JSON Web Token (JWT) headers, claims, and human-readable exp/iat/nbf timestamps 100% locally in your browser—never leak bearer tokens to external servers.
Token Lifecycle & Claims Summary
JOSE Header
Claims Payload
How JSON Web Tokens (RFC 7519) Work & Why Offline Decoding Matters
A JSON Web Token (JWT, standardized in RFC 7519) is a compact, URL-safe credential format composed of three Base64URL-encoded segments separated by dots: Header.Payload.Signature. Critical security note: standard JWS tokens are signed, not encrypted—anyone holding the token string can Base64URL-decode its header and claims without possessing the signing key.
Because bearer access tokens and OIDC ID tokens grant live API privileges until their exp (expiration) epoch timestamp elapses, pasting production Authorization headers into server-side debugging websites risks token replay if access logs or analytics scripts capture request payloads. NetDevKit parses Base64URL segments strictly inside your local browser tab with zero network traffic.
When auditing JWT security in production gateways (Envoy, Kong, AWS API Gateway), always reject the "alg": "none" header, pin asymmetric verification keys (RS256, ES256, or EdDSA) against expected JWKS endpoints, and validate iss (issuer), aud (audience), and clock-skew tolerances on exp and nbf.