JWT inspector
This JWT inspector decodes a JSON Web Token so you can read its header and payload claims, such as who the token is about and when it expires. Developers use it while debugging logins and APIs. It does not check whether the token is genuine.
- Runs in your browser
- Free, no account needed
- Copy or download the result
Result
Example
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJleGFtcGxlIiwiZXhwIjoxNzAwMDAwMDAwfQ.
UNTRUSTED DECODE ONLY. Signature, issuer, audience and authorization have NOT been verified.
{
"header": {
"alg": "none",
"typ": "JWT"
},
"payload": {
"sub": "example",
"exp": 1700000000
},
"numericDateUTC": {
"exp": "2023-11-14T22:13:20.000Z"
},
"signatureBytes": 0
}How to use the jwt inspector
- Paste a three-part token into the Three-part JWT box. Use a test token, not a live one.
- Press Run. There are no options to set.
- Read the header, payload, UTC dates and signature length in the result.
- Copy result or Download it if you need to keep the decoded claims.
How it works
The token must have exactly three parts separated by dots. Five-part encrypted tokens (JWE) are rejected.
The header and payload must each be Base64url-encoded JSON objects. Anything else stops with an error that names the bad part.
Numeric iat, nbf and exp claims are also shown as UTC dates, but the tool does not tell you whether the token has expired.
The signature is only decoded to count its bytes. It is not checked against any key.
Every result starts with a warning that the signature, issuer, audience and authorization have NOT been verified.
Everything runs in your browser. Your input is not uploaded or stored.
Questions and answers
Does this verify the JWT signature?
No. It only decodes the token. Anyone can create a token with any claims, so do not trust decoded values until your server verifies the signature with the correct key.
Is it safe to paste my token here?
Decoding runs in your browser and the token is not sent anywhere. A live token can still grant access if it leaks, so a test or expired token is the safer choice.
Why are five-part tokens not supported?
A five-part token is an encrypted JWE. Its claims cannot be read without the decryption key, so this tool only accepts three-part signed-format tokens.
How do I read the exp claim?
exp is a count of seconds since 1 January 1970 UTC. The tool converts it to a readable UTC date in the numericDateUTC section.