/public/tools/

JWT inspector

Paste a JSON Web Token. The header and payload are base64url-decoded, the exp, iat and nbf timestamps are resolved to human time, and the claims are audited for the things that bite: alg: none, a missing or runaway expiry, a token that is not valid yet, and secret-looking data sitting in a payload anyone can read. It runs entirely in your browser.

examples

decoding…

Header

claimvaluemeaning

Payload

claimvaluemeaning

The three parts

A signed JWT is header.payload.signature, three base64url strings joined by dots. The header and payload are each base64url-encoded JSON, which is why this tool can read them with no key. The signature is a MAC or digital signature over header.payload. Decoding tells you what a token says; only verifying the signature with the right secret or public key tells you whether to believe it.

The alg:none trap

The header names the signing algorithm. If it says alg: "none", the token is unsigned and the signature segment is empty. The danger is on the verifying side: a server that honors the header's alg can be handed a none token with rewritten claims and accept it. The same family of bug is the RS256→HS256 confusion attack, where an attacker signs with the public key as if it were an HMAC secret. The fix is always the same: the verifier pins the algorithm it expects and ignores what the token asks for.

The payload is not a secret

A JWT is signed, not encrypted. The payload is base64url, not ciphertext. Anyone who holds the token, including the browser it is stored in, can read every claim. Putting a password, an API key, or PII in a JWT does not hide it; it ships it. If a claim must stay secret from the bearer, a JWT is the wrong container (or you want JWE, encrypted tokens, which this tool does not decode).

Registered claims (RFC 7519)

claimmeaning
issIssuer. Who minted and signed the token.
subSubject. The principal the token is about, often a user id.
audAudience. Who the token is for. The verifier should reject a token whose aud is not itself.
expExpiration time (NumericDate). Reject at or after this instant.
nbfNot before (NumericDate). Reject until this instant.
iatIssued at (NumericDate). When the token was created.
jtiJWT ID. A unique identifier, used to detect or block replay.

What this tool does not do

It does not verify the signature. It cannot, without your shared secret or the issuer's public key, and a decoder that asks you for the secret is the last thing you should paste a production secret into. It does not decrypt encrypted (JWE) tokens, check aud or iss against your configuration, or confirm a jti has not been replayed. It reads structure and claims and flags hygiene problems. Treat a clean result as “well-formed,” never as “authenticated.”

Single static HTML file, no network. Your token never leaves the browser, which is the only kind of JWT decoder you should paste a real token into. Source: github.com/truffle-dev/tool-jwt-inspector. MIT.