JWT Inspector

Encoding & Decoding

Decode JSON Web Tokens and inspect payload claims locally.

Local Browser JWT Inspector

Raw Encoded JWT (Header.Payload.Signature)

Expired (Thu, 28 May 2026 20:26:40 GMT)

Header (Algorithm & Type)

{
  "alg": "HS256",
  "typ": "JWT"
}

Signature Segment

5xL_SAMPLE_SIGNATURE_HASH_DO_NOT_USE_IN_PROD

Payload Claims Data

{
  "sub": "usr_value_9918",
  "name": "Alex Chen",
  "email": "alex@example.com",
  "role": "engineer",
  "iat": 1742000000,
  "exp": 1780000000,
  "iss": "devtools-hub"
}

Technical Specification & Client Security

Decode JSON Web Tokens and inspect payload claims locally. All formatting, transformations, and diffing algorithms run directly in your browser using local Web Workers and client RAM. No source code, authentication tokens, or database queries are sent across the network.

›Instant decoding of JWT Header (algorithm, token type) and Payload claims

›Automated expiration verification against exp, iat, and nbf timestamps

›100% Client-side decoding in local RAM: no tokens or API keys sent to any backend

›Human-readable UTC expiry translation and active validity status badge

›Copy individual segments (Header, Claims, Signature) in one click

›Persistent workspace state stored locally in your browser

Input & Output Transformation Examples

Decoded Header Object

Input:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Output:

{
  "alg": "HS256",
  "typ": "JWT"
}

Decoded Payload Claims

Input:

...eyJzdWIiOiIxMjM0NTYiLCJuYW1lIjoiQWxleCIsImlhdCI6MTUxNjIzOTAyMn0...

Output:

{
  "sub": "123456",
  "name": "Alex",
  "iat": 1516239022
}

Frequently Asked Questions

Is it safe to paste production bearer tokens or OAuth JWTs here?

Yes. Unlike standard online JWT parsers that send tokens to remote servers, our decoder runs 100% locally via client-side Base64Url string decoding. Verify this anytime via your browser's Network tab (0 outbound requests).

Does this tool verify cryptographic HMAC or RSA signatures?

This tool displays the raw signature string and decodes claims. Full cryptographic signature verification requires supplying your private key or secret, which we intentionally avoid asking for to preserve absolute client-side security.

How does the token expiration check work?

The inspector reads standard UNIX timestamp claims (exp for expiry, iat for issued-at, nbf for not-before) and compares them against your local machine's current time to calculate remaining validity.

Related Developer Utilities

JSON Formatter

Base64 Codec

HTTP Client