JWT Inspector
Decode a JSON Web Token, check its signature and see when it expires.
- Never uploaded
- Works offline
- Free, no sign-up
Processed on this device. Nothing is sent to a server.
How to use the JWT Inspector
- Step 1Paste your tokenOr load the sample to try it.
- Step 2Read the claimsThe header and payload decode as you type.
- Step 3Check the signatureAdd the secret or public key. It stays in this tab.
What is a JWT?
A JSON Web Token (JWT) is a compact, signed string with three parts separated by dots: a header, a payload of claims, and a signature. Servers issue them after you sign in and check the signature on every request, so they don’t need to keep a session.
The header and payload are only base64url-encoded, not encrypted. Anyone holding the token can read them. The signature only proves that the token was issued by someone who holds the key and that nobody changed it since.
Questions
Is it safe to paste a production token here?
Yes. The token is decoded by JavaScript running in this tab. Nothing is sent to a server, and the token and key are not saved anywhere. You can check this in your browser’s network panel, or disconnect from the internet and the tool keeps working.
Why does it say the signature is invalid?
Usually the key is wrong: a different secret, a public key from another environment, or a secret that is base64-encoded when the tool expects plain text (or the other way around). It is also invalid if any character of the header or payload was changed after signing.
Which algorithms are supported?
HS256, HS384 and HS512 with a shared secret; RS256, RS384, RS512, PS256, PS384 and PS512 with an RSA public key; and ES256, ES384 and ES512 with an EC public key. Public keys are pasted in PEM format.
Can this tool decrypt an encrypted token (JWE)?
No. Encrypted tokens have five parts instead of three and need the private key to read. This tool reads signed tokens (JWS), which is what almost all APIs use.
Does it work offline?
Yes. After your first visit the site is cached by your browser, so you can open it and decode tokens without an internet connection.