JWT Inspector
Security /jwtDecode JWT headers and payloads locally, with timestamp interpretation, without claiming signature verification.
Paste a complete header.payload.signature token.
Decoded payload will appear here.
Decoded header will appear here.
Paste a JWT. It is decoded locally as you type. 1 line 109 B local only
How it works
Decode JWT headers and payloads locally, then inspect claims and key timestamps safely.
Use it to inspect public JWT claims and timestamps while debugging token shape.
Example
Decode header and payload JSON, then check whether the exp timestamp is in the past.
Notes
- This tool decodes and inspects only. It does not verify signatures.
- Header and payload must be valid Base64URL-encoded UTF-8 JSON.
- Send the payload to the JSON formatter or any other tool from the output menu.
Constraints
- Decoding is not signature verification and does not prove a token is trustworthy.
- Limit: 1 MiB token. Nothing is uploaded or silently truncated.
Common errors
- Wrong segment count
- Malformed Base64URL
- Assuming decoded means verified
When to use it
Use it to inspect public JWT claims and timestamps while debugging token shape.
Formats: Three-part compact JWT, Base64URL JSON header and payload.