Home›Developer Tools›JWT Inspector
Token Debugger

JWT Inspector — Decode JSON Web Tokens Instantly

Paste any JWT to see its Header, Payload, and Signature broken down, with human-readable timestamps for exp, iat, and nbf. Decoding happens entirely in your browser — your token is never sent anywhere.

🔑 Paste Your JWT

100% client-side — nothing is uploaded or logged.
Paste a token above and click Decode
⚠️

Disclaimer: This tool decodes JWT Header and Payload data for informational and debugging purposes only — it does not verify the Signature, since that requires a secret or public key this client-side tool never asks for. A decoded token is not a verified token. Always validate signatures server-side using a trusted JWT library before granting access based on a token's contents.

How JWTs Work

A JSON Web Token is three base64url-encoded segments joined by dots: header.payload.signature.

Important: The Header and Payload are only encoded, not encrypted — anyone can decode them (that's what this tool does). Never put secret data in a JWT payload. Only the Signature provides tamper-evidence, and only if verified against the correct key.

Step-by-Step: What Happens When You Decode

  1. Step 1: The token is split on each . into three parts.
  2. Step 2: Each of the Header and Payload parts is base64url-decoded (- → +, _ → /, then standard base64 decode) back into a JSON string.
  3. Step 3: The JSON string is parsed and pretty-printed. Any exp, iat, or nbf fields (Unix timestamps) are converted to readable local and UTC dates.
  4. Step 4: The Signature segment is shown as-is (raw base64url) since it cannot be decoded into readable data — it's cryptographic output, not encoded JSON.

Common JWT Claims Reference

ClaimNameMeaning
issIssuerWho created and signed the token
subSubjectThe user or entity the token is about
audAudienceIntended recipient(s) of the token
iatIssued AtUnix timestamp when the token was created
expExpirationUnix timestamp after which the token is invalid
nbfNot BeforeUnix timestamp before which the token is not valid

Frequently Asked Questions

A JWT is a compact, URL-safe token made of three base64url-encoded parts separated by dots: a Header (algorithm/type), a Payload (claims/data), and a Signature (verifies the token wasn't tampered with). Commonly used for authentication and authorization in web APIs.
No. This tool only decodes the Header and Payload, which requires no secret since they're just base64url-encoded JSON, not encrypted. Verifying the Signature requires the issuer's secret or public key, which this client-side tool intentionally does not ask for or handle.
Decoding happens entirely in your browser — the token is never sent to any server. That said, treat access/ID tokens as sensitive credentials: avoid pasting production tokens into any third-party tool when you can use a test or expired token instead.
iat (issued at) is when the token was created. exp (expiration) is when it stops being valid. nbf (not before) is the earliest time it becomes valid. All three are Unix timestamps, which this tool converts to human-readable local and UTC time.