Decode JWT header and payload locally so you can inspect claims and expiry quickly.
The ByteKiln JWT Decoder splits your token into its three Base64URL-encoded segments and decodes each locally in your browser. For HMAC tokens, it also verifies the signature using the Web Crypto API — no network request is made.
A JWT token is three Base64URL segments separated by dots. The decoder splits, decodes, and pretty-prints each segment as JSON. Your token never leaves the browser — all decoding uses client-side JavaScript.
For HS256, HS384, and HS512 tokens, enter your HMAC secret in the Signature panel. The tool re-computes the expected signature using SubtleCrypto.sign() and compares it byte-for-byte against the token's embedded signature.
The claims inspector shows human-readable dates for exp, iat, and nbf. Security warnings appear when the algorithm is "none", when exp is missing from the payload, or when the token has already expired.
Short answers for the things developers usually ask before trusting a tool.
Yes — for HS256, HS384, and HS512 tokens. Enter your HMAC secret in the Signature panel and the tool verifies the signature locally using the browser's SubtleCrypto API. RS256 and asymmetric algorithms are not yet supported.
Yes. If the payload includes an exp claim, the tool compares it against the current time and shows a clear Valid or Expired status badge. The exact expiry date and time are also displayed.
The tool warns when the algorithm is set to "none" (no cryptographic signature), when the exp claim is missing entirely, or when the token has already expired. These are common JWT security issues to watch for.
No. The ByteKiln JWT Decoder runs entirely in your browser. Your token is decoded locally using JavaScript and never transmitted, logged, or stored anywhere.
The header identifies the token type and signing algorithm (e.g. HS256). The payload contains the claims — statements about the subject like user ID, roles, and expiry time. Both sections are Base64URL-encoded JSON objects.
Useful follow-ups when one conversion usually turns into three more.