Data

JWT Inspector

Decode header and payload JSON, inspect claimed times, and keep verification limits visible.

Decode only. Treat every claim as untrusted. This inspector does not verify signatures, issuers, audiences, authorization, or token validity. No secrets or signing keys are requested.

Paste a token or inspect the deliberately unsecured fictional sample.

Tab indents ยท Esc, then Tab moves focus Ln 1, Col 1

50,000-character limit. Input stays in this tab. No persistent token storage, URL parameters, or history list. Ctrl/Cmd+Enter inspects.

Select and copy any part of this code. Ln 1, Col 1
JSON

No decoded result.

Read a JWT without mistaking decoding for verification

A JSON Web Token can carry readable Base64URL-encoded header and payload objects. This tool decodes that representation locally and formats JSON without rounding its numeric tokens. The displayed data remains untrusted, including any algorithm name, issuer URL, identity, or permission.

How to inspect a token

  1. Paste the token directly into the editor. The tool does not read tokens from links or URL parameters.
  2. Select Inspect token or use Ctrl/Cmd+Enter. Review the header, payload, signature-segment state, and notices.
  3. Read iat, nbf, and exp as claimed UTC times when their numeric values can be represented exactly to a millisecond. These displays do not decide whether a token is valid or expired.
  4. Copy or download the decoded JSON report if needed. Clear token and result removes the current display; the editor's Undo action can restore earlier input during this tab session.

What does a signature segment mean?

Two segments are accepted for inspection, with a notice that compact JWS serialization is incomplete. A trailing dot means the signature segment exists but is empty. A nonempty third segment only means bytes are present. No cryptographic operation verifies those bytes. An alg value of none receives an explicit unsecured-token notice.

Strict input handling

Unpadded Base64URL, canonical trailing bits, UTF-8, JSON syntax, and duplicate keys are checked. Both decoded segments must be JSON objects. Five-part encrypted JWE tokens and unencoded b64:false payloads are unsupported. Critical header parameters are shown but not interpreted. URLs inside claims and headers are never followed.

Input is limited to 50,000 characters, JSON nesting to 100 levels, expanded inspection to 500,000 characters, and worker processing to five seconds. Finer-than-millisecond or out-of-range NumericDate claims retain their exact token and show a display notice. Editing clears prior decoded output immediately.

Privacy and trust boundaries

No token is sent to a verification service or stored in application history. The editor keeps temporary undo history in memory, and explicit copying or downloading creates a separate copy under your control. Use fictional or redacted tokens when sharing results. The included sample is deliberately fictional and unsecured.

Official references

See RFC 7519: JSON Web Token for the representation and NumericDate claims, and RFC 8725: JWT Best Current Practices for the separate validation and trust decisions a real application must make.

Related Tools