JWT inspector
Paste a JSON Web Token. The header and payload are base64url-decoded, the exp, iat and nbf timestamps are resolved to human time, and the claims are audited for the things that bite: alg: none, a missing or runaway expiry, a token that is not valid yet, and secret-looking data sitting in a payload anyone can read. It runs entirely in your browser.
decoding…
Header
| claim | value | meaning |
|---|
Payload
| claim | value | meaning |
|---|
The three parts
A signed JWT is header.payload.signature, three base64url strings joined by dots. The header and payload are each base64url-encoded JSON, which is why this tool can read them with no key. The signature is a MAC or digital signature over header.payload. Decoding tells you what a token says; only verifying the signature with the right secret or public key tells you whether to believe it.
The alg:none trap
The header names the signing algorithm. If it says alg: "none", the token is unsigned and the signature segment is empty. The danger is on the verifying side: a server that honors the header's alg can be handed a none token with rewritten claims and accept it. The same family of bug is the RS256→HS256 confusion attack, where an attacker signs with the public key as if it were an HMAC secret. The fix is always the same: the verifier pins the algorithm it expects and ignores what the token asks for.
The payload is not a secret
A JWT is signed, not encrypted. The payload is base64url, not ciphertext. Anyone who holds the token, including the browser it is stored in, can read every claim. Putting a password, an API key, or PII in a JWT does not hide it; it ships it. If a claim must stay secret from the bearer, a JWT is the wrong container (or you want JWE, encrypted tokens, which this tool does not decode).
Registered claims (RFC 7519)
| claim | meaning |
|---|---|
| iss | Issuer. Who minted and signed the token. |
| sub | Subject. The principal the token is about, often a user id. |
| aud | Audience. Who the token is for. The verifier should reject a token whose aud is not itself. |
| exp | Expiration time (NumericDate). Reject at or after this instant. |
| nbf | Not before (NumericDate). Reject until this instant. |
| iat | Issued at (NumericDate). When the token was created. |
| jti | JWT ID. A unique identifier, used to detect or block replay. |
What this tool does not do
It does not verify the signature. It cannot, without your shared secret or the issuer's public key, and a decoder that asks you for the secret is the last thing you should paste a production secret into. It does not decrypt encrypted (JWE) tokens, check aud or iss against your configuration, or confirm a jti has not been replayed. It reads structure and claims and flags hygiene problems. Treat a clean result as “well-formed,” never as “authenticated.”
Single static HTML file, no network. Your token never leaves the browser, which is the only kind of JWT decoder you should paste a real token into. Source: github.com/truffle-dev/tool-jwt-inspector. MIT.