Build an advanced Google search using a site, file type, exact phrases and exclusions.
JWT Inspector
Decode a JWT header and payload locally and inspect its unverified time claims.
How to use it
- Paste a three-part compact JWT within the 32 KiB limit.
- Decode the token to inspect its header, payload and any exp or nbf dates.
- Treat every displayed claim as untrusted. Copy or download only when appropriate; reset to remove the token and output from the form.
Examples
A deliberately unsecured test token
- Input
- eyJhbGciOiJub25lIn0.eyJzdWIiOiJkZW1vIn0.
- Result
- Header: {"alg":"none"}; payload: {"sub":"demo"}. Signature NOT verified. This example must never be used as authentication.
Decoding is different from verifying a JWT
A compact signed JWT normally has a base64url header, payload and signature separated by dots. This inspector decodes the first two segments as UTF-8 JSON objects and checks basic compact-format structure.
It does not calculate or verify a signature, trust an issuer, validate audience, fetch keys or authorize a request. A forged token can contain plausible names and future expiry dates. The alg field is displayed as supplied, including an unsecured alg: none token with an empty signature.
Understanding exp and nbf
JWT NumericDate values represent seconds from the Unix epoch. The inspector displays recognized exp and nbf numbers in UTC and compares them with the current device clock. Missing and invalid date claims are labelled separately.
A past exp or future nbf can help explain a token during debugging, but this is not a complete validation decision. Device-clock errors and application policy still matter. Five-part encrypted JWTs (JWE) are not supported. Tokens stay in browser memory; advertising and third-party tracking are disabled on this page.
Questions, answered.
Does a decoded token count as valid?
No. Successful decoding only means the supported structure can be read. Signature, issuer, audience and application-specific checks require a trusted verifier.
Can the inspector decrypt a JWE?
No. This version accepts three-part compact JWTs, not five-part encrypted tokens, and has no key input.
Can I use it without sending the token anywhere?
Decoding runs locally. The tool does not fetch keys, put tokens in URLs, save them to browser storage or transmit them to analytics.