JWT Inspector
Decode and inspect JSON Web Tokens — headers, claims, expiration, and signature at a glance.
Encoded
Recent tokens
Decoded
Nothing decoded yet
Paste a token to see its header and payload decoded here.
Everything runs locally in your browser — your tokens and keys never leave your device.
JWT Inspector FAQ
- Is it safe to paste a production token here?
- Decoding and verification run entirely in your browser; the token, secret and keys are never sent to a server. Still, treat live tokens as credentials and rotate any that leak.
- Which signature algorithms can be verified?
- HMAC (HS256/384/512) with a shared secret, and RSA, RSA-PSS, ECDSA and EdDSA with a PEM public key or a JWKS.
- What does the security audit check?
- It flags risky headers such as alg: none, and checks time claims like exp and nbf so you can see whether a token is expired or not yet valid.
- Does decoding a JWT prove it is valid?
- No. Anyone can decode the header and payload; only a successful signature check with the right key proves the token was not tampered with.
- Does the inspector remember my tokens?
- Only if you opt in. With "Remember the last 5 tokens" checked, valid tokens are kept in this browser's localStorage — never uploaded — and you can remove one or clear them all at any time; unchecking it deletes them.