JWT Inspector

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts separated by dots: the Header (algorithm & type), the Payload (claims), and the Signature.

Standard Claims

The JWT specification (RFC 7519) defines registered claim names such as iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), and iat (issued at). This inspector explains each one in plain English.

Security Considerations

• Never use alg: none — it disables signature verification.
• Always set an expiry (exp) to limit token lifetime.
• Keep token lifetimes short — prefer < 1 hour for access tokens.
• Verify the signature server-side using the issuer's public key or secret.

How to Use It

Paste a token into the box — it parses as you type, no button needed. The Token Timing card shows issued-at, not-before, and expiry with a live countdown, so you can tell at a glance whether the "authentication failed" bug you're chasing is really just an expired token (it usually is). The three panels below show the decoded header, the payload with every claim explained in plain English, and the raw signature. If anything looks off — alg: none, a missing expiry, a lifetime over a year — a security warning appears above the panels. No token handy? Load Sample fills in a realistic (expired) example to explore.

Frequently Asked Questions

Is it safe to paste a token here?

The decoding happens entirely in your browser — nothing is sent to any server, and nothing is stored. That said, a live access token is a credential, so the sensible habit is to inspect expired tokens or ones from a dev environment when you can. Never paste a signing secret anywhere, including here.

Why can't it verify the signature?

Verification requires the secret key (for HMAC algorithms) or the issuer's key material — and a browser tool that asked you to paste your secret would be teaching you a terrible habit. This inspector decodes and explains; verification belongs on your server.

Aren't JWTs encrypted?

The common kind (JWS) isn't — the header and payload are just Base64URL-encoded, which is why this tool can read them without any key. That's worth internalizing: anything you put in a JWT payload is readable by anyone who holds the token. Don't put secrets in claims.

What do the timestamps in the payload mean?

exp, iat, and nbf are Unix timestamps — seconds since 1970. The claims table converts them to your local time next to the raw value, so you don't have to paste numbers into an epoch converter.