JWT Tool

A lightweight, privacy-focused JWT decoder that runs entirely in the browser.

The application allows developers to inspect JSON Web Tokens (JWTs) without sending any information to external servers. Everything is processed locally, making it suitable for debugging tokens in secure environments.

https://decoderjwt.netlify.app/

Features

• ✅ Decode JWT Header
• ✅ Decode JWT Payload
• ✅ Local processing only
• ✅ No network requests
• ✅ Content Security Policy (CSP)
• ✅ Clear decoded data
• ✅ Simple and lightweight interface
• ✅ No external libraries
• ✅ No internet connection required

Privacy

All JWT processing happens entirely inside your browser.

• No backend
• No API calls
• No analytics
• No tracking
• No cloud services

Your JWT tokens never leave your computer.

Security

This application includes a restrictive Content Security Policy (CSP) to reduce the attack surface and prevent unexpected external communication.

Configured protections include:

• Only local resources are allowed.
• Network requests are blocked (connect-src 'none').
• Embedded objects and plugins are disabled.
• Frames and iframes are blocked.
• Form submissions are disabled.
• External communication is prevented.
• The application is designed to work completely offline.

Technologies

• HTML5
• CSS3
• Vanilla JavaScript

No frameworks or third-party dependencies are required.

How to Use

1. Open index.html in your browser.
2. Paste a JWT token into the input field.
3. Click Decode.
4. The application will display:
   • JWT Header
   • JWT Payload
5. Click Clear to reset the application.

Notes

This tool is intended for JWT inspection and debugging.

The current version does not verify JWT signatures. It simply decodes the Base64Url-encoded Header and Payload sections of the token.

Browser Compatibility

Compatible with all modern browsers, including:

• Google Chrome
• Microsoft Edge
• Mozilla Firefox
• Safari
• Brave

Project Structure

.
├── index.html
├── style.css
├── app.js
└── README.md

Future Improvements

Planned features include:

• JWT signature verification (HS256, RS256, ES256)
• Secret key input
• Public key validation
• Token expiration analysis (exp, iat, nbf)
• Human-readable date conversion
• Syntax highlighting
• Copy Header/Payload individually
• Real-time decoding while typing

License

This project is provided as-is for educational and development purposes.