JWT Decoder

WHAT IT DOES

JWT Decoder decodes JSON Web Tokens (JWTs) into a readable format, displaying the header, payload, and signature sections. The tool validates the token structure, checks for expiration, and shows key claims like issued at (iat), expiration (exp), and not before (nbf). Each section is displayed with syntax highlighting for keys and values, making it easy to inspect token contents. You can copy the decoded data in multiple formats (formatted, JSON, or raw token), and the tool can automatically detect JWT tokens from the current page. Expired tokens are highlighted with a warning, and optional raw data display shows the base64-encoded parts.

WHERE IT RUNS

The extension runs entirely within your browser's local environment using the BotGentz framework. All token decoding, validation, and formatting occur on your machine without any network requests. No JWT data, decoded contents, or user activity is ever transmitted, uploaded, or stored externally. The tool works on any website and respects the browser's security boundaries, operating within the isolated extension sandbox. Token decoding uses the browser's native atob and JSON.parse functions.

HOW TO USE

Click the extension toolbar icon to open the JWT Decoder panel. Paste a JWT token into the input field and click "Decode" to display the decoded header and payload sections. Click "Detect from Page" to automatically find JWT tokens in the current page's content. Click "Copy" to copy the decoded data in your chosen format. Click "Clear" to reset the panel. Toggle "Auto decode on input" to automatically decode tokens as you type or paste. Toggle "Show raw data" to display the raw base64-encoded parts. Toggle "Highlight expired tokens" to show a warning for expired tokens. Toggle "Show claims" to display standard JWT claims (issued at, expiration, not before). Choose the "Copy Format" from the dropdown (Formatted, JSON, or Raw Token). The panel displays header and payload sections with syntax highlighting for different value types.

THE JWT DECODING ENGINE — WHY IT WORKS

Most JWT decoders simply base64-decode the parts and display them as plain text. This tool provides a structured, human-readable view by parsing the decoded JSON and displaying it with proper indentation and syntax highlighting. The engine splits the token into three parts using the dot separator, then decodes the header and payload using base64UrlDecode (which handles URL-safe characters '-' and '_'). The decoded JSON is parsed into JavaScript objects, and the engine recursively traverses the object tree to render keys and values with appropriate styling. Expiration validation checks the 'exp' claim against the current timestamp. The auto-detect feature searches for JWT patterns (eyJ... ) in page content using regex. The copy function supports three formats: formatted (header and payload with indentation), JSON (structured data), and raw (the original token). This approach provides a complete, user-friendly JWT inspection experience.

THE PANEL

The JWT Decoder panel is fully draggable by its title bar and remembers its position on screen per website. It snaps to the edges of your browser window for clean alignment. Collapse the panel to a compact icon strip using the minimize button, restoring it with a single click. Resize the panel by dragging any edge or corner; the input area and decoded output adjust proportionally. Press the Escape key to close the panel instantly. The panel maintains independent state for each browser tab, allowing you to decode tokens in multiple tabs simultaneously.

PLEASE NOTE

This extension requires the free BotGentz extension framework to be installed and enabled. The tool decodes JWT tokens locally; it does not validate signatures or verify token authenticity. The expiration check is based on the 'exp' claim and is informative only. The auto-detect feature looks for JWT patterns in page content; it may not detect all tokens, especially if they're obfuscated or split across multiple elements. All token data is processed locally and is never transmitted, logged, or shared. The extension requests no network permissions and functions entirely offline. The source code is fully auditable and available for review.