JWT Inspector
Decode JSON Web Tokens and inspect their header, payload, and signature.⌘⏎ run · ⇧⌘C copy · ⎋ resetINPUTExpected algorithm
Field appears only when an HMAC algorithm is selected — driven by JSONLogic visibility expression.
OUTPUT
❯ _Run an operation to see results here.then press ⌘⏎
ADSponsored
What is JWT Inspector?
The JWT Inspector splits a JSON Web Token into its header, payload and signature, base64url-decodes the parts and shows every claim in readable form with humanized timestamps. Decoding happens entirely in your browser, so it is safe to inspect real tokens — nothing is transmitted. It is the fastest way to see what is inside a token when debugging auth.
How to use it
- 01Paste the full token (header.payload.signature).
- 02Read the decoded header and payload claims.
- 03Check iat/exp/nbf, shown as real dates.
FAQ
Is it safe to paste a real token?
Yes — decoding is local to your browser. Still avoid sharing a permalink of a live token.
Does it verify the signature?
It decodes and shows the claims; verifying requires the signing secret or public key.
What does "exp" mean?
The expiry time — after it, the token should be rejected. It is shown as a human-readable date.
Examples
Decode the default token{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFseSIsImlhdCI6MTcxMjUwMDAwMH0.x"
}