JWT Decoder / Inspector / Validator
Decode, inspect, and verify JWT tokens — header, payload, claims, and HMAC signatures. Everything runs in your browser
| Claim | Value | Meaning | Status |
|---|
RSA and EC signature verification
RSA and EC signature verification requires importing public keys via the Web Crypto API. This feature is planned for a future update.
For HMAC-based tokens (HS256, HS384, HS512), full signature verification is available now using the HMAC Secret option.
RSA and EC signature verification
RSA and EC signature verification requires importing public keys via the Web Crypto API. This feature is planned for a future update.
For HMAC-based tokens (HS256, HS384, HS512), full signature verification is available now using the HMAC Secret option.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format for securely transmitting information between parties. It consists of three Base64URL-encoded parts separated by dots.
Header
The header typically contains two fields: the signing algorithm (alg) and the token type (typ).
Payload (Claims)
The payload contains claims — statements about the user and metadata. Standard claims include:
| Claim | Name | Description |
|---|---|---|
iss | Issuer | Who issued the token |
sub | Subject | Who the token is about |
aud | Audience | Intended recipient of the token |
exp | Expiration | When the token expires (Unix timestamp in seconds) |
nbf | Not Before | Token is not valid before this time |
iat | Issued At | When the token was created |
jti | JWT ID | Unique identifier for the token |
Signature
The signature is created by encoding the header and payload, joining them with a dot, and signing with the algorithm specified in the header.
base64UrlEncode(header) + "." + base64UrlEncode(payload),
secret
)
Common Misconceptions
Security Best Practices
Tips
Decode Does Not Mean Trust
Anyone can decode a JWT — Base64URL is not encryption. Decoding reveals the contents, but only signature verification proves the token has not been tampered with.
Check Expiration Before Use
The exp (expiration) claim is a Unix timestamp in seconds. Always check that it is in the future before trusting a token. This tool shows the time status instantly.
alg: none Is a Security Risk
The "none" algorithm means the token has no signature. Accepting it in production can allow attackers to forge tokens. Always reject alg: none on your server.
JWTs Are Not Encrypted by Default
Standard JWTs (JWS) are only signed, not encrypted. The payload is readable by anyone with the token. Never store passwords, credit card numbers, or other secrets in a JWT payload.
Common Use Cases
API Debugging
Paste access tokens from API responses to quickly inspect claims, check expiration, and verify the issuer without leaving your browser.
Auth Flow Testing
Decode tokens at each step of OAuth2 or OpenID Connect flows to verify that the correct scopes, audience, and claims are present.
Token Expiration Monitoring
Check when tokens expire to debug session timeout issues. The tool shows human-readable time differences like "expires in 14 minutes".
CI/CD Pipeline Verification
Verify that service-to-service tokens contain the expected claims before deploying. Paste tokens from pipeline logs to inspect them.
Security Auditing
Inspect tokens for sensitive data leaks (PII in payload), weak algorithms (alg: none), or missing security claims (exp, aud, iss).