JWT Inspector
Decode the header and payload of any JWT token locally, so the token never leaves your browser.
About JWT Inspector
Debugging authentication issues often means peeking inside a JWT, but pasting a real token into an online decoder can leak credentials to a third party. This inspector decodes the header and payload entirely in your browser, so you can examine a token's claims without ever sending it anywhere.
Paste a token and press decode, and the tool splits the three dot-separated parts, Base64URL-decodes the header and payload, and presents the JSON claims readably. Expiry timestamps are converted to readable dates, and expired tokens are flagged. Because decoding is purely local, no network request is involved.
Backend developers use it to check what claims a token carries and whether expiry is set correctly, while front-end developers inspect tokens returned from login endpoints when debugging authorization errors. Anyone building or integrating APIs that use JWTs finds it useful for verifying a token's contents before trusting it.
How to Use
- Paste a JWT token.
- Press Decode.
- Review the header, payload, and expiry information.
Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.sig { alg: "HS256", typ: "JWT" } / { sub: "123" }
A JWT has three dot-separated parts: header, payload, and signature. This tool decodes the first two Base64URL segments.
FAQ
Does this verify the JWT signature?
No — verification requires the secret or public key. This tool only inspects the readable header and payload.
Is it safe to decode tokens here?
Yes, decoding runs entirely in your browser and nothing is sent anywhere, but never share real tokens regardless.
What is the 'exp' claim?
The expiration timestamp. The inspector converts it to a readable date and flags expired tokens.
Can I decode a token signed with any algorithm?
Yes, decoding works the same way for any algorithm because this tool only reads the header and payload; the signature is not verified. To verify a signature you'd need the secret or public key, which is intentionally never requested here.
Why does my token decode but still fail on the server?
A successful decode just means the token is well-formed. The server likely rejects it because of a bad signature, an expired exp claim, an issuer or audience mismatch, or clock-skew issues. Check those claims against what the server expects.