Inspect JWT Claims Without Trusting Them
Inspect readable token claims while keeping signature verification and authorisation decisions in the receiving application.
Use the interactive tool ↓Separate decoding from verification
A typical signed JWT contains Base64URL-encoded header and payload segments followed by a signature segment. Decoding the first two reveals JSON; it does not establish who created the token or whether any claim should be trusted.
JWT Decoder
Use fictional claims for inspection
Use Load sample to inspect the built-in example. Its readable name and subject are demonstration data, not proof of an authenticated user. The signature can be syntactically present while having no valid relationship to your application’s expected signing key.
- Identify the header’s declared algorithm without treating it as a policy decision.
- Read issuer, audience and subject claims when present.
- Compare numerical time claims with the expected UTC instant.
- Verify the token in the actual receiving system before using its contents.
The decoder can accept header/payload input without a normal complete signed-token envelope. That is useful for inspection, but means successful decoding is not comprehensive JWT format validation.
Read timestamps without over-interpreting the badge
The exp, iat and nbf claims use numeric seconds, rather than JavaScript milliseconds. The interface displays supported numerical claims as UTC dates. exp describes expiry, iat issuance and nbf a not-before constraint.
The expiry badge is only a client-clock comparison. “Not expired” is not “valid”: the decoder does not verify a signature, enforce the intended audience or issuer, validate not-before, or establish whether a server has revoked access. A missing expiry badge likewise says nothing about trust.
Keep inspection data safe
Do not paste live bearer tokens or private user claims into an unfamiliar session. Browser-side decoding means the tool’s processing does not upload the token, but it does not change the sensitivity of credentials copied through your clipboard or visible to other software on the device.
Troubleshoot an unreadable token
Check copied dot-separated segments and distinguish an encrypted token from a simple readable signed-token format. This tool does not decrypt JWE payloads. RFC 7519 defines JWT claims and processing requirements; the application must apply its own trusted-key and validation policy. Use Unix Timestamp Converter for a separate fixed-time check, with the Seconds option selected.