JWT Decoder & Inspector
JWT Decoder & Inspector reads a compact JSON Web Token in your browser and shows you what is inside it.
Paste a compact JWT (header.payload.signature) to inspect its header, payload and claims locally. The token is never uploaded.
How to use it
- Paste a compact JWT (header.payload.signature) into the input field
- Click Decode JWT to split and decode the token locally
- Read the header, the payload, and the table of registered claims, with exp, nbf, and iat shown as UTC and local dates
- Check the time-status line and the security notes — the signature is shown but not verified
A compact JWT has three parts separated by dots — a header, a payload, and a signature — and each of the first two parts is a base64url-encoded JSON object. This tool splits the token, decodes the header and payload, pretty-prints both as JSON, and lists the registered claims defined by RFC 7519: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not valid before), iat (issued at), and jti (JWT ID), alongside any custom claims the token carries. The three time claims exp, nbf, and iat are also converted from their NumericDate seconds into a readable UTC date and your local time, and a plain time-status line tells you whether the token is expired, not yet valid, currently inside its declared window, or has no expiration claim at all. Those checks use your own device's clock. The signature part is displayed as its original base64url string and, when it decodes, its length in bytes, but it is never checked: this version does no signature verification and never asks for a secret or a key. Reading a token is not the same as verifying it — decoding shows what a token claims, not who issued it or whether it can be trusted, and a token that declares alg=none simply carries no signature at all. Remember that a standard signed JWT payload is encoded, not encrypted, so anyone holding the token can read the same claims you see here. Everything runs locally: the token you paste is never uploaded, logged, or stored anywhere. Unlike the Password Generator, which creates human passwords, the Secure Token Generator, which produces random secrets, or the SHA Hash Generator and Base64 tools, which transform arbitrary data, this tool only parses the structure of a token that already exists.
FAQ
A JSON Web Token is a compact, URL-safe string with three dot-separated parts — a header, a payload of claims, and a signature — commonly used to carry identity or session information between services.
No. Decoding only reveals the header and payload that anyone can read. Verifying means checking the signature against a key, which this tool deliberately does not do.
Yes. A standard signed JWT (a JWS) is encoded with base64url, not encrypted, so any party that holds the token can decode and read every claim inside its payload.
They are time claims counted in seconds since 1 January 1970 UTC: exp is when the token expires, nbf is the earliest moment it should be accepted, and iat is when it was issued.
No. The token is decoded entirely in your browser with base64url and JSON parsing. It is never sent to a server, written to storage, or logged, and closing the tab discards it.