What is the JWT Header & Payload Viewer?
The JWT Header & Payload Viewer is a lightweight, open-source, client-side web utility built with SvelteKit and Bootstrap. It lets developers instantly decode and read the header and payload of any JSON Web Token (JWT) directly in the browser — without ever sending the token to a server.
Unlike online JWT debuggers that require you to paste tokens into third-party services, this tool runs 100% locally. Your sensitive tokens never leave your device, making it ideal for debugging authentication flows, inspecting access tokens, or teaching JWT concepts in a safe environment.
Why It Was Built
Most JWT tools on the web are convenient but risky. They transmit your token to remote servers, which can log, store, or even misuse it. For security-conscious developers, this is unacceptable — especially when working with production credentials or internal APIs.
This viewer eliminates that risk by using only native browser APIs (atob, JSON.parse) to decode Base64Url segments. The signature is ignored (as intended for inspection), and no network requests are made after the initial page load.
Key Features
- Instant Decoding – Paste any JWT, see header and payload instantly
- Human-Readable Timestamps –
exp,iat,nbfconverted to UTC dates - Raw vs. Pretty View – Toggle between decoded JSON and original Base64Url
- Copy to Clipboard – Export header or payload with one click
- Responsive Design – Works on mobile, tablet, and desktop
How It Works
When you paste a JWT like eyJhbGciOiJIUzI1NiIs..., the app:
- Splits the token by
. - Decodes the first two segments using Base64Url rules
- Parses them as JSON
- Displays them with syntax-aware formatting
Who Should Use It?
Frontend engineers verifying auth tokens, backend developers debugging OAuth flows, security auditors reviewing token claims, and educators teaching JWT structure — all benefit from a safe, offline-capable viewer.
FAQ
Does it verify signatures?
No. Signature verification requires the secret key and is intentionally omitted for privacy and simplicity.
Can I use it offline?
Yes! After the first load, all assets can be cached. Add it as a PWA for full offline access.
Is the source code open?
Absolutely. Available on GitHub under MIT license.
Start decoding JWTs securely today — no servers, no logs, no risk.