Decode JSON Web Tokens (JWT) Privately In-Browser
JSON Web Tokens (JWT, RFC 7519) secure modern OAuth 2.0, OpenID Connect, and distributed API microservice architectures. Inspecting token claims (such as expiration dates, user IDs, and assigned role scopes) is a routine debugging task for software engineers and security professionals.
Pasting production authorization tokens into online cloud decoders poses a serious data breach hazard, as active session credentials can be intercepted or stored in server access logs. TabKit decodes JWT header and payload segments locally using client-side Base64URL parsing. It displays formatted JSON claims and calculates expiration status without transmitting any data over the network.
RFC 7519 Token Structure
A JSON Web Token consists of three distinct segments separated by dots (.):
- Header: Defines the token type (
JWT) and cryptographic signing algorithm (e.g.RS256,ES256,HS256). - Payload: Contains the identity claims, user attributes, permissions, and session timestamps.
- Signature: Cryptographic hash ensuring token integrity against tampering.
Standard Registered Claims
- exp: Expiration Time (Unix timestamp after which token is rejected)
- iat: Issued At timestamp denoting token generation time
- iss: Principal issuer URI that created the token
- sub: Subject identifier (unique user ID or system principal)
- aud: Audience intended recipients for this token
Frequently Asked Questions
Does this tool verify the JWT signature?
This utility inspects and decodes the token header and payload claims. Signature verification requires server-side public keys, but local inspection lets you examine tokens without sharing secrets.
How does the tool calculate expiration time?
The tool parses the standard "exp" timestamp claim and compares it with your computer local clock to indicate whether the token is active or expired.
Are authorization tokens sent to any external server?
Never. Decoding runs 100% locally in your browser memory. Your authentication tokens remain confidential.