Decode JWT headers and payloads instantly — inspect claims, expiry, and algorithm before trusting a token. Debug auth failures in seconds — local processing, free, no signup.
Content reviewed October 2026 · About Toolzum
Decode and inspect JWT tokens — view header, payload, expiration, issuer, subject, and other standard claims. Paste an HMAC secret to genuinely verify HS256/384/512 signatures — local inspection, free, no signup.
Decode Base64 strings and pretty-print JSON data — paste encoded text to see the decoded result instantly. Inspect API payloads and tokens readably — free, local, no signup.
Decode MessagePack binary into readable JSON structures. Debug compact payloads without hex dumps — local decoding, free, no signup.
Convert between Roman numerals and numbers both ways — chapters, clocks, movie credits. Decode MCMXCIV as 1994 instantly — local math, free, no signup.
Convert YAML configs to TOON token-efficient format for LLM prompts. Shrink context payloads measurably — local conversion, free, no signup.
Three base64 parts: header (algorithm), payload (claims like sub, exp, iat), and signature. Paste a token to read all three sections with expiry converted to dates.
Structure decodes always; signature verification needs the secret or public key. Never trust claims from an unverified token in production code.
Compare the exp claim against current Unix time — clock skew beyond a minute also fails strict validators. Regenerate tokens with realistic lifetimes.
No — decoding runs locally in your browser. Tokens never leave your device, but never paste production secrets into any web tool.
HS256 (expired) and RS256 (valid) presets plus Clear. Inspect demands exactly 3 dot-separated parts, then reports EXPIRED vs Valid-until ISO dates, missing exp/iss, and algorithm, typ, kid, sub, aud, iat, nbf and jti rows. Copy confirmations reset after 1500 ms and the report downloads as jwt.json.
JWT Encoder & Signer
Build and sign JWTs with HS256/RS256 — headers, claims, expiry, and signature verification. Mint test tokens without backend roundtrips — local crypto, free, no signup.
Two-Factor Auth Generator
Generate TOTP URIs for two-factor authentication setup with authenticator apps. Code never leaves your device — formatting and validation run locally in your browser.