JWT Decoder & Signature Inspector
RFC 7519 compliant client-side debugger, timestamp parser, and cryptographic verifier.
Paste a dot-delimited compact base64url token (header.payload.signature).
exp)
iat)
-
-
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "usr_9984210",
"name": "Sarah Connor",
"admin": true,
"iat": 1740000000,
"exp": 1771536000,
"iss": "https://auth.toolacre.internal"
}
Standard & Custom Claims Analyzer
| Claim Name | Raw Value | RFC Semantic Interpretation | Status / Offset |
|---|---|---|---|
| sub | "usr_9984210" | Subject identifier (Unique principal or account id) | Valid ID |
| name | "Sarah Connor" | Full human-readable display name | String |
| admin | true | Custom boolean authorization permission flag | Privileged |
| iat | 1740000000 | Issued At: Wednesday, Feb 19, 2025 (Epoch Seconds) | Valid |
| exp | 1771536000 | Expires: Friday, Feb 20, 2026 (Epoch Seconds) | In 365 Days |
| iss | "https://auth.toolacre.internal" | Issuer authority issuing the JWT principal claims | HTTPS URI |
Pasting production signing secrets (HS256 symmetric seeds or private RSA/EC keys) into any browser tool creates potential operational exposure if third-party browser extensions or clipboard sniffers are present. Always verify tokens using public keys or rotate temporary staging credentials.
ToolAcre uses native W3C window.crypto.subtle primitives directly inside this sandbox. Computations happen entirely within non-persisted local RAM with zero network fetch requests, WebSockets, or remote telemetry back-channels.
Compact JWT serialization transforms bytes using Base64URL encoding (RFC 4648 §5), substituting + with - and / with _ while omitting padding. ToolAcre enforces strict character validation.