Does this JWT decoder verify the signature?

No. This tool decodes the base64url header and payload, then explains the claims it can read. Signature verification needs the issuer's secret or public key and must happen in your application or a trusted local/server-side verifier before you rely on any claim.

Is it safe to paste a production access token here?

The component runs entirely in your browser and deliberately does not put the token in the URL or call an external API. A JWT is still a bearer credential, so production tokens should be treated like passwords: use a local trusted environment when possible and rotate the token if it was exposed.

What does the claims inspector check beyond decoding JSON?

It reads common registered and application claims, converts NumericDate fields to human time, and flags risky situations such as alg=none, expired tokens, future nbf/iat values, missing exp, and likely millisecond timestamps. These checks help you debug 401 and 403 issues quickly, but they do not replace policy checks in your backend.

Why does a token with readable claims still fail authentication?

JWT payloads are just base64url-encoded JSON, so a malformed, expired or tampered token can still decode cleanly. Servers also validate signature, issuer, audience, clock skew, scopes, token type and revocation state, any one of which can reject a token whose claims look reasonable.

What is the difference between exp, nbf and iat?

`exp` is the expiration time, `nbf` is the earliest time the token should be accepted, and `iat` is when the token was issued. JWT NumericDate values are Unix timestamps in seconds, not milliseconds, which is why this tool warns when a value looks like JavaScript milliseconds.

Diagnose an API 401 before touching backend code

Paste the bearer token from the failed request and check exp, nbf, iat, iss and aud in one panel. If the token expired two minutes ago or was minted for the wrong audience, you can fix the client refresh or OAuth configuration instead of chasing route handlers.

Verify whether a role or scope is actually present

When a user can log in but cannot access an admin action, decode the token and inspect scope, scp, roles, groups and permissions. Seeing the missing claim makes it clear whether the issue is the identity provider mapping, the token request, or your backend authorization policy.

Catch dangerous JWT debugging shortcuts

Tokens with alg=none, missing exp, future nbf, or millisecond-looking NumericDate values often point to real implementation mistakes. The inspector surfaces those signals as explicit checks so reviewers do not have to infer them from raw JSON.

Compare header key metadata during SSO rotations

During a JWKS or SSO key rotation, read the alg, kid, typ and cty fields before checking your verifier cache. If the kid does not match a currently published key, the problem is probably stale key material rather than the token payload itself.

JWT Decoder and Claims Inspector

Decode JWT headers and payloads locally, inspect registered claims, timing, audience and risk signals.

Runs locally
Category Developer & DevOps
Best for Formatting, validating, shrinking, or inspecting code-adjacent text.

Runs locally in this tab. JWT input is not uploaded, saved, or placed in the URL.

JWT input0 characters

Paste a JWT to inspect its claims.

The token stays in the browser. The result will show header metadata, registered claims, timing status and risk findings.

What this tool does

Browser-only JWT decoder and claims inspector for developers debugging authentication flows. Paste a JSON Web Token to decode the header, payload and signature, then review registered claims such as iss, sub, aud, exp, nbf, iat, jti, scope and roles. The inspector highlights expiry status, not-before windows, likely millisecond timestamps, alg=none, missing audience or expiration claims, and the important reminder that decoding is not signature verification. Nothing is uploaded or written to the URL, so bearer tokens stay inside the current tab.

Tool details

Input: Text + Structured content; The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output: Live result + Copy; The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy: Browser-side processing; The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share: Shareable URL state; Key settings are encoded in the URL so another person can reopen the same setup.
Performance budget: Initial JS <= 32 KB; No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit: Developer & DevOps · Developer; Category and role tags drive related tools, internal links, and quick fit checks.

How to use

1. Input

Paste or drop your content into the tool panel.
2. Process

Click the button. All processing is local in your browser.
3. Copy / Download

Copy the result or download to disk in one click.

How JWT Decoder and Claims Inspector fits into your work

Use it in the small gaps between coding, reviewing, debugging, and shipping.

Developer jobs

Formatting, validating, shrinking, or inspecting code-adjacent text.
Preparing snippets for documentation, tickets, commits, or handoff.
Checking a small payload quickly without switching tools.

Developer checks

Run irreversible transforms like minify or obfuscate on a copy.
Keep secrets out of pasted snippets unless the tool explicitly stays local.
Use your normal tests or linter before shipping transformed code.

Good next steps

These links move the current task into a more complete workflow.

Real-world use cases

Diagnose an API 401 before touching backend code
Paste the bearer token from the failed request and check exp, nbf, iat, iss and aud in one panel. If the token expired two minutes ago or was minted for the wrong audience, you can fix the client refresh or OAuth configuration instead of chasing route handlers.
Verify whether a role or scope is actually present
When a user can log in but cannot access an admin action, decode the token and inspect scope, scp, roles, groups and permissions. Seeing the missing claim makes it clear whether the issue is the identity provider mapping, the token request, or your backend authorization policy.
Catch dangerous JWT debugging shortcuts
Tokens with alg=none, missing exp, future nbf, or millisecond-looking NumericDate values often point to real implementation mistakes. The inspector surfaces those signals as explicit checks so reviewers do not have to infer them from raw JSON.
Compare header key metadata during SSO rotations
During a JWKS or SSO key rotation, read the alg, kid, typ and cty fields before checking your verifier cache. If the kid does not match a currently published key, the problem is probably stale key material rather than the token payload itself.

Common pitfalls

Treating a clean decode as proof of validity. Anyone can base64url-encode JSON; only signature verification and issuer/audience checks make claims trustworthy.
Reading JWT NumericDate values as JavaScript milliseconds. JWT exp, nbf and iat are Unix seconds, so multiplying or dividing at the wrong layer creates confusing clock bugs.
Sharing a debug URL that contains a token. This tool avoids URL state for JWT input because bearer tokens often grant live access while they remain valid.

Privacy

JWT input is treated as sensitive. Decoding and claim inspection happen with plain JavaScript in the browser tab, no API request is made, and the token is never synchronized into the page URL. Clipboard actions only run when you press a copy button. If the token grants production access, rotate it after any accidental disclosure.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Browse all tools for this role

JWT Decoder and Claims Inspector

Paste a JWT to inspect its claims.

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How JWT Decoder and Claims Inspector fits into your work

Developer jobs

Developer checks

Good next steps

Real-world use cases

Diagnose an API 401 before touching backend code

Verify whether a role or scope is actually present

Catch dangerous JWT debugging shortcuts

Compare header key metadata during SSO rotations

Common pitfalls

Privacy

FAQ

JWT Decoder

JWT Encoder

Unix Timestamp Converter

Base64 Encoder & Decoder

HMAC Generator

CSP Generator

AI Eval Planner

Apache Cheatsheet

API Key Generator

API Rate Limit Cheatsheet

ASCII Table Generator

ASCII Table Reference