JWT Decoder & Token Inspector
Inspect token claims, issuer (`iss`), subject (`sub`), audience (`aud`), expiration dates (`exp`), and issued-at timestamps (`iat`). Note: Client-side decoding inspects payload contents but does not verify cryptographic server signatures.
What is the JWT Decoder & Token Inspector?
This tool decodes and inspects JSON Web Tokens (JWT) client-side, displaying the Header, Payload claims, expiration timestamps, and signature status without sending tokens to any server.
RFC 7519 Base64URL Decomposition and Claims Inspection
A JSON Web Token consists of three parts separated by periods: Header, Payload, and Signature. Both Header and Payload are Base64URL encoded JSON objects. The decoder pads the strings, replaces URL-safe characters (- and _) with standard Base64 characters (+ and /), and decodes them to UTF-8 strings before parsing them into JSON. Timestamps representing seconds since Jan 1, 1970 UTC are multiplied by 1,000 to construct JavaScript Date objects.
How to Use the JWT Decoder & Token Inspector
Paste Encoded Token
Paste your JWT string (beginning with eyJ...) into the input box.
Inspect Header & Claims
View the signing algorithm (e.g. RS256, HS256) and user claims (sub, email, roles, scopes).
Check Expiration Status
Look at the live expiry badge to verify whether the token is currently active or expired.
Key Settings & Parameters
| Setting | What It Controls | Recommended Default |
|---|---|---|
| Token Input | Accepts standard 3-part JWTs formatted as header.payload.signature. | Ensure no leading or trailing whitespace |
Common Pitfalls to Avoid
-
• Assuming decoding a JWT verifies its authenticityDecoding merely reads the Base64URL payload. A decoded token can be modified by anyone; only cryptographic signature verification proves it was issued by your auth server.
-
• Storing sensitive passwords or PII in JWT payloadsJWT payloads are only encoded, not encrypted. Anyone who intercepts the token can read all claims inside it.
Pro Tips for Best Results
- Check the "exp" claim first when debugging 401 Unauthorized API responses—token expiration is the #1 cause of sudden authentication failures.
Local Processing Guarantee
Zero server uploads. Your access tokens, user IDs, and session credentials never leave your browser.
When to Use
- Debugging authentication and authorization issues in OAuth2, OIDC, Auth0, Firebase, or Supabase integrations.
- Verifying token expiration times and checking whether token refresh logic is functioning.
- Auditing user permissions, tenant IDs, and RBAC roles embedded in API access tokens.
- • This tool decodes and inspects the token payload. It intentionally does not ask for or store your private signing keys in the browser.