JWT input
Paste one compact JWT. Nothing is sent by this tool.
Inspect a JWT without transmitting it
A JSON Web Token (JWT) has three dot-separated Base64URL parts: a header, a payload, and a signature. This page decodes the first two JSON objects and shows the signature data separately.
The token stays in the page while you inspect it. It is never put in the address bar, so copying the URL does not copy the token.
Keep token material out of the URL
JWTs can contain identifiers and other sensitive claims. This tool is designed so the pasted value remains local to the page:
- Decoding uses browser APIs only; there is no upload step.
- The token is not stored in the URL or a share link.
- The source code is available under the MIT License.
Treat a JWT as sensitive even when its payload is readable. Read the source code.
How to inspect a token
-
Paste the compact JWT
Paste a token in the form header.payload.signature into the text area.
-
Decode its parts
Read the JSON header and payload, then inspect the encoded signature separately.
-
Check time claims
When exp, iat, or nbf is numeric, the page shows its date and marks expired or future values.
Frequently asked questions
Does this verify the JWT signature?
No. This page only decodes the compact token format. A readable payload is not proof that it was issued by a trusted party or has not been changed.
What do exp, iat, and nbf mean?
They are NumericDate claims in seconds since the Unix epoch: expiration time, issued-at time, and the time before which a token must not be accepted.
Why is my token rejected?
The message identifies whether the token has the wrong number of parts, invalid Base64URL data, or invalid JSON in the header or payload.
Can this decode an encrypted JWE?
No. JWE decryption and JWT signing or generation are outside this tool.