Is it safe to paste production JWTs into this tool?

Yes! Unlike cloud-based JWT debuggers, ToolByte processes all decoding and HMAC signature checks entirely within your browser sandbox in RAM. No HTTP requests are sent.

What signing algorithms are supported for signature verification?

Currently HMAC-SHA256 (HS256) is supported for live cryptographic verification via window.crypto.subtle. Header and payload decoding works for all algorithms including RS256, ES256, and EdDSA.

How does the expiration timer work?

The exp claim represents seconds since the Unix epoch. The tool compares this timestamp against the current local system clock to determine if the token is active or expired.

JSON Web Token (JWT) Decoder & Secret Inspector

Decode, inspect payload claims, check expiration countdown, and verify HMAC-SHA256 signatures 100% locally.

Security Guarantee: 100% Client-Side In-Browser Execution. Computations run locally within browser RAM. Zero remote telemetry.

Technical Overview & Architecture

A client-side JSON Web Token (JWT) decoder and signature verifier. Parse header, payload claims (iss, sub, exp, nbf, iat), check live expiration timers, and verify HMAC-SHA256 signatures without sending secret keys or tokens over the internet.

JWT tokens are split into three Base64Url-encoded strings. The browser decodes each JSON segment using TextDecoder and atob. Signature verification is performed by hashing the header and payload with your provided secret key via window.crypto.subtle.sign().

Key Capabilities & Features

Air-Gapped Token Decoding: Decodes Base64Url token components in memory with zero network requests or third-party logging.
Live Expiration Countdown & Timestamps: Calculates active vs expired status, remaining validity duration, and converts UNIX timestamps to local timezone dates.
Hardware-Accelerated HMAC Verification: Verify HMAC-SHA256 signatures locally using the Web Crypto API without exposing your private secret key.
Registered Claims Inspector: Instantly view Subject (sub), Issuer (iss), Audience (aud), Issued At (iat), and Not Before (nbf) variables.

Step-by-Step Usage Guide

Paste JWT Token: Enter your raw JWT string into the editor box or load the demo token.
Inspect Claims & Expiry: View formatted JSON for the Header and Payload, alongside real-time token validity badges.
Verify HMAC Signature: Optionally enter your HMAC secret key to verify signature authenticity with Web Crypto API.

Frequently Asked Questions (FAQ)

Is it safe to paste production JWTs into this tool?: Yes! Unlike cloud-based JWT debuggers, ToolByte processes all decoding and HMAC signature checks entirely within your browser sandbox in RAM. No HTTP requests are sent.
What signing algorithms are supported for signature verification?: Currently HMAC-SHA256 (HS256) is supported for live cryptographic verification via window.crypto.subtle. Header and payload decoding works for all algorithms including RS256, ES256, and EdDSA.
How does the expiration timer work?: The exp claim represents seconds since the Unix epoch. The tool compares this timestamp against the current local system clock to determine if the token is active or expired.