Zero-Leak Client-Side JWT Decoder
Unlike traditional JWT tools that may send your sensitive tokens to a server for processing, DevPantry's JWT Decoder runs 100% locally in your browser using the native WebCrypto API. Your tokens, secrets, and decoded payloads never leave your machine.
Advanced Authentication Chaos Testing
Decoding a token is just the first step. DevPantry goes further by allowing you to actively tamper with JWTs to test your backend's resilience:
- Expired Token Simulation: Instantly rewind the `exp` claim to generate an expired token.
- Algorithm Exploits: Test the infamous `alg: none` exploit to ensure your API rejects unsigned tokens.
- Signature Verification: Input a secret key to verify the token signature using WebCrypto.
- Claim Injection: Inject edge-case data, null values, or large payloads to test input validation and database constraints.
Supported Algorithms
We support standard JSON Web Signature (JWS) algorithms including HS256, HS384, HS512, RS256, and more, all processed client-side. Whether you are debugging an OIDC ID token, a Supabase session, or a custom microservice JWT, DevPantry provides a safe sandbox environment.
Related Tools
- API Templates — Test your decoders with real OAuth and OIDC responses.
- Mock Data Generator — Synthesize custom edge-case claims.