Free online tools that run in your browser
Your files never leave your device · No login required · 100% free
Search results
Why LMPB Tools?
Simple, private tools that just work — right in your browser.
- Private Everything runs in your browser. Files are never uploaded.
- No login required No account, no sign-up, no email. Just open a tool and use it.
- Fast No upload or download wait — results appear instantly.
- Free All tools are free to use, with no limits.
- Works everywhere Phone, tablet or computer, in any modern browser.
🆕 New tools
★ Popular tools
Recently used
Frequently asked questions
Are my files or text uploaded anywhere?
No. Every tool runs inside your browser on your own device. Nothing you enter or open is sent to a server.
Do I need to create an account or log in?
No login is required. There are no accounts — open any tool and start using it straight away.
Are the tools really free?
Yes. All tools are free, with no limits or watermarks. The site is supported by ads.
Does it work on my phone?
Yes. The tools work in any modern browser on phones, tablets and computers.
Can I use the tools offline?
Once a tool has loaded it does its work on your device, so it keeps working even if your connection drops.
All tools with descriptions →
JWT Decoder
Decode a JSON Web Token: header, payload, readable exp/iat dates and expiry status. Verify HS256, RS256, ES256 and more. Token stays on your device.
Paste a JSON Web Token to see what is inside: the header with the signing algorithm, the payload with all its claims, and the expiry time in plain words — “Expired 2 hours ago” or “Valid — expires in 14 minutes”. Add the secret or the issuer's public key to check that the signature is genuine.
Tokens often grant access to real accounts, so this decoder runs entirely in your browser. The token is never uploaded, logged or stored.
How to use JWT Decoder
- Paste the token (with or without “Bearer ” in front).
- Read the decoded header and payload, and the expiry status at the top.
- Check the claims table: exp, iat and nbf are shown as dates in your time zone and in UTC.
- To verify the signature, enter the secret (HS256/384/512) or paste the public key as PEM or JWK (RS, PS, ES, EdDSA).
Features
- Decodes the header and payload of any signed JWT (JWS); big numbers stay exact.
- Colour-coded token: header, payload and signature at a glance.
- Readable dates for exp, iat and nbf with a live “expires in …” status.
- Explains the registered claims: iss, sub, aud, exp, nbf, iat, jti and more.
- Signature verification with the browser's Web Crypto: HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512 and EdDSA.
- Public key as PEM (SPKI) or JWK; paste a whole JWKS and the key is chosen by kid.
- Warns about unsigned tokens (alg: none) and refuses private keys.
- 100% private: nothing is sent to a server.
What is a JWT?
A JSON Web Token (JWT, pronounced “jot”) is a compact, URL-safe way to send signed information, most often to prove who a user is after logging in. It looks like three blocks of letters joined by dots: header.payload.signature. The header and payload are JSON encoded with base64url; the signature proves that nobody changed them.
Anyone can decode a JWT — it is encoded, not encrypted. Only the signature check needs a key. So never put passwords or other secrets in a JWT payload.
Standard JWT claims
Claims are the fields in the payload. These registered claims are defined in RFC 7519; applications add their own, such as name, email or roles.
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who created and signed the token |
| sub | Subject | Who the token is about, usually a user ID |
| aud | Audience | Which service the token is meant for |
| exp | Expiration time | Seconds since 1970-01-01 UTC after which the token is invalid |
| nbf | Not before | The token is not valid before this time |
| iat | Issued at | When the token was created |
| jti | JWT ID | A unique ID, used to stop the same token being replayed |
JWT signing algorithms
The alg field in the header says how the token was signed. HMAC algorithms (HS) use one shared secret for signing and checking. RSA (RS, PS), ECDSA (ES) and EdDSA use a private key to sign and a public key to verify, so any service can check tokens without being able to create them.
| Algorithm | Type | Verify with |
|---|---|---|
| HS256 / HS384 / HS512 | HMAC with SHA-2 | The shared secret |
| RS256 / RS384 / RS512 | RSA PKCS#1 v1.5 | RSA public key (PEM or JWK) |
| PS256 / PS384 / PS512 | RSA-PSS | RSA public key |
| ES256 / ES384 / ES512 | ECDSA on P-256 / P-384 / P-521 | EC public key |
| EdDSA | Ed25519 | Ed25519 public key |
| none | Not signed | Nothing — never trust these tokens |
Why is my token expired?
exp is a number of seconds since 1 January 1970 (UTC). Access tokens are usually short-lived — 5 minutes to 1 hour — and are refreshed by the app in the background. If a token shows as expired, the app should request a new one with its refresh token. Also check the clock of the computer that checks the token: a few minutes of clock difference can make fresh tokens look expired or not yet valid.
Is it safe to paste a JWT into a website?
Only if the website does not send it anywhere. A valid token can give access to an account until it expires, so treat it like a password. This decoder works entirely in your browser — you can disconnect from the internet after the page loads and it still works. Verification uses only public keys or the secret you type, and the tool refuses to accept private keys.
Frequently asked questions
Is this JWT decoder free and private?
Yes. It is free and runs entirely in your browser. Your token, secret and keys are never sent to a server.
Can I decode a JWT without the secret?
Yes. The header and payload are only base64url-encoded, so they can always be read. The secret or public key is needed only to check that the signature is genuine.
Why does it say “Invalid signature”?
Either the token was changed after it was signed, or you used a different secret or key. For HS256, check whether your secret is stored Base64-encoded and tick the option if so. For RS256 and ES256, use the issuer's public key — often available as a JWKS at /.well-known/jwks.json.
Which key formats are supported?
Public keys as PEM “PUBLIC KEY” (SPKI) or as a JWK. You can also paste a whole JWKS key set; the right key is picked by the kid in the token header. Certificates and PKCS#1 “RSA PUBLIC KEY” files must be converted first — the tool tells you how.
Can it decode encrypted tokens (JWE)?
No. Encrypted tokens have five parts and can only be read with the recipient's private key, which should never be pasted into a website.
How do I read the exp value?
exp is a Unix timestamp in seconds. The decoder shows it as a date in your time zone and in UTC, and says how long until (or since) it expires. You can also convert any timestamp with the Unix Timestamp Converter.
Is a JWT encrypted?
No — a normal JWT is signed, not encrypted. Anyone who has it can read the payload, so never store secrets in it.