JWT Inspector

Example#

The tool opens with a sample token. Its header is {"alg": "HS256", "typ": "JWT"} and its payload holds a subject, an issue time (iat) and an expiry (exp) one hour away. The result shows the status Active, the expiry as "in 1 h" and each claim with its meaning. Paste your own token to replace it.

How it works#

A JWT has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON written in base64url, which is an encoding, not encryption. The tool splits the token on the dots, decodes each part as UTF-8 text and parses the JSON. A leading "Bearer ", spaces and surrounding quotes are removed first.

It then reads the registered claims: iss (issuer), sub (subject), aud (audience), exp (expires at), nbf (not before), iat (issued at) and jti (token ID). Dates in a JWT are seconds since 1 January 1970 UTC. The tool shows each date in UTC and in your local time, with a relative time such as "in 2 h 14 min" or "3 days ago".

The status compares those dates with your device clock, refreshed every 30 seconds: Expired when the current time is at or after exp, Not yet valid when it is before nbf, Active when there is an exp that has not passed, and No expiry when the token has no exp. A token with five parts is an encrypted token (JWE); the tool shows its header only, because the payload cannot be read without the key.

Assumptions#

• The token is a compact JWT: three dot-separated parts, or five for an encrypted token.
• Time claims are numbers of seconds since the Unix epoch.
• Your device clock is correct; the status depends on it.
• The token is at most 64 KB.

Use cases#

• Checking why an API returns 401 by seeing whether the token has expired.
• Confirming which audience, issuer and scopes a token carries.
• Reading the algorithm in a token's header while debugging authentication.
• Spotting tokens that never expire or live for a very long time.

Limitations#

Decoding a token does not prove it is genuine. The tool never checks the signature, so a forged token decodes just as well as a real one. Verify signatures with the issuer's key in your own code. The tool also cannot decrypt encrypted tokens, edit tokens or create new ones.

It warns about a few risky patterns: the algorithm "none" (an unsigned token), no expiry, an expiry earlier than the issue time, a lifetime longer than 30 days and an issue time in the future. These are hints, not a security review.

Decoding happens in your browser, and the token is not stored or sent anywhere. Even so, anyone who holds a live token can use it until it expires, so avoid pasting production tokens into any website.