JWT & Token Inspector

Decode, inspect, and analyze JSON Web Tokens instantly. Guaranteed zero server transmission: all tokens remain in local browser memory.

Security Notice — Client-Side Decoding Only

This tool strictly decodes the token payload in your local browser sandbox. It does NOT verify cryptographic signatures without the server's public key or secret. Never paste production secrets or signing keys here.

Encoded Token

Status

Active

Valid until expiration

Algorithm

HS256

Type: JWT

Subject (sub)

1234567890

Header (Algorithm & Token Type)

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload (Claims & Data)

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "admin": true,
  "iat": 1516239022,
  "exp": 2524608000
}

Signature

4fA1_U4c4F62P7N0hX7QfS7w_u0f-1nB4V_iN7wQ118

Technical Guide to JSON Web Tokens

A JSON Web Token (RFC 7519) is a compact, URL-safe means of representing claims to be transferred between two parties. The token is composed of three Base64URL-encoded strings separated by dots:

Header: Specifies the cryptographic algorithm (e.g. HS256, RS256) and token type.
Payload: Contains statements about an entity (typically the user) and additional metadata (claims such as sub, iss, exp).
Signature: Created by taking the encoded header, encoded payload, a secret, and signing them with the specified algorithm.

Zero Server Transmission

Your security tokens and authorization headers are never logged, tracked, or sent to backend endpoints.

Signature Disclosure

Decoding does not equate to cryptographic verification. Only a system with the matching private key or HMAC secret can verify integrity.

Expiry Evaluation

Accurately translates Unix epoch timestamps into UTC and local browser dates to spot expired tokens immediately.