JWT Inspector
Paste a JWT and get a full breakdown: the JOSE header (algorithm, type, key id), every registered and custom claim with a description, an expiry check (expired / valid / not-yet-valid), a visual iat → nbf → exp timeline, and signature details. The signature is never verified — only decoded — and the tool warns you about that loudly.
How to use
- 1
Paste your JWT
Drop the full compact token (header.payload.signature) into the input.
- 2
Inspect
The tool decodes the base64url header and payload and shows every claim with a description.
- 3
Check expiry
The status banner tells you if the token is expired, valid, or not yet valid (nbf).
- 4
Read the timeline
Visualise iat → nbf → exp against the current time so you can see the token's lifetime at a glance.
Common use cases
- Debug why a token is being rejected by your API (expired, wrong audience, wrong issuer).
- Inspect third-party tokens (e.g. from OAuth providers) to see which claims they include.
- Confirm the signing algorithm before wiring up verification on your server.
- Teach yourself the JWT structure: header, payload, signature, and registered claims.
Limitations
- Signature is never verified. Decoding a JWT does not prove authenticity. Always verify on the server.
- The tool reads
algfrom the header, which an attacker can forge — never trust client-side claims. - Encrypted JWTs (JWE, alg starting with a
.or 5-part structure) are not supported. - Tokens larger than 64 KB are truncated in the textarea.
Frequently asked questions
Related tools
View allJWT Decoder
Decode the header and payload of a JSON Web Token.
Base64 Decoder
Decode Base64 strings back to text or binary.
API Response Visualizer
Paste JSON and visualize it as a tree, table or cards.
JSON Formatter
Beautify and indent JSON with 2 or 4 spaces.