How to Decode a JWT Token on iPhone Offline

A JWT (JSON Web Token) is the long eyJ… string you see in Authorization: Bearer headers. It holds the user ID, roles, and the token’s issue and expiry times. You can paste it into a website to read it, but a JWT is a live credential. Sending it to a third-party site is a bad habit. The Toolbox in HTTPS Capture decodes it on your iPhone, offline.

Decode a JWT

1. Copy the token. If you captured it, open the request, tap Headers, and copy the value after Bearer .
2. Open the Toolbox tab and choose JWT Decoder.
3. Paste the token.

You’ll see three parts:

• HEADER: the algorithm (alg, such as HS256 or RS256) and token type, as formatted JSON
• PAYLOAD: the claims, such as sub, iss, aud, exp, iat and any custom fields
• SIGNATURE: the raw signature segment

The decoder reads the token; it doesn’t verify the signature. That needs the secret or public key. A decoded token is not proof that it is valid.

Check when the token expires

The exp and iat claims are Unix timestamps, such as 1767225600. Copy the number and open Timestamp Converter in the Toolbox to see the date and time in your time zone. This is the fastest way to check whether “401 Unauthorized” simply means the token expired.

The rest of the Toolbox

All tools run on the device, and Recent keeps the ones you use most at the top. There is a search field too.

Encoding & Hashing

• Base64, URL encode/decode, HTML entities, Unicode escape
• Hash Generator: MD5, SHA-1, SHA-256, SHA-512

Data & Formatting

• JSON Formatter (pretty-print or minify), XML Formatter, SQL Formatter
• JSON to Swift (Codable model declarations)
• Property List: convert between JSON and XML plist

Time & Numbers

• Timestamp Converter, Time Zone Converter, Date Difference
• Number Base Converter, UUID Generator

Web & Text

• JWT Decoder, URL Parser, Query String parser and builder
• HTTP Status Codes reference, Regex Tester, QR Code Generator
• SSL Certificate Checker

Why offline matters

Tokens, request bodies and query strings copied from real traffic often contain credentials or personal data. Online decoders receive whatever you paste. Doing the work on your own iPhone keeps that data on the device, next to the traffic you captured.