Hoxy

Identity

JWT Decoder

Decode JWT header and payload without sending secrets to a server.

Sensitive processing stays in your browser whenever possible.

Details

The JWT decoder shows header and claims so expiry, audience, issuer, and roles can be inspected. Signature verification requires keys and server-side checks.

Do not paste real user tokens into public tools. This utility is for controlled troubleshooting and identity-team training.

Treat alg=none claims or weak algorithms seriously; misconfigured auth libraries remain a classic bug class.

Tips

  • Short-lived access tokens and rotating refresh tokens reduce theft impact.
  • Do not trust role claims in the client; authorization must be re-enforced server-side.
  • Avoid leaving tokens in localStorage when a safer option exists against XSS.