JWT Inspector
JWT Inspector - a browser-based developer tools utility.
Browser tool
About JWT Inspector
Decoding a token to read its header, claims and expiry, and verifying a signature against a secret you supply. Worth saying plainly at the start: a JWT is encoded, not encrypted, and anyone holding one can read everything in it. Free, online, and account-free by design. The token is decoded in your browser and never uploaded, which is the only responsible way to handle one.
How to use it
- Paste the tokenThe three dot-separated segments are decoded and shown as readable JSON.
- Read the claims and datesIssued-at, expiry and not-before are numeric timestamps in the raw token and are rendered as dates here.
- Verify only with a test secretSignature checking needs the signing key. Use a development one — a production secret should not be pasted into any web page, including this one.
Base64url is not encryption
The header and payload of a standard JWT are base64url-encoded JSON, which any tool can decode without a key. The signature proves the token was issued by someone holding the secret and has not been altered; it does nothing to hide the contents. Putting anything confidential in a claim means publishing it to whoever holds the token.
The alg: none attack
The specification permits an algorithm of "none", meaning unsigned. A verifier that trusts the header to choose its algorithm can be handed a token claiming none and will accept an unsigned forgery. Correct implementations fix the expected algorithm on their side rather than reading it from the token, and this flags a none-algorithm token clearly for exactly that reason.
What it does not do
- Decoding proves nothing about validity. Only verification against the right key does that, and only your server knows the key.
- A valid signature does not mean the token is still current — check expiry and not-before as well.
- Nothing pasted here is transmitted, which is precisely why the advice is still to use a test token.
Questions people ask
- Is it safe to paste a JWT into a web tool?
- Nothing here is transmitted, which you can verify in the network panel. Even so, treat a production token as a live credential — anyone who obtains it can act as that user until it expires. Use a test token whenever you can.
- Can I see the payload without the secret?
- Yes, and so can anybody else. The payload is merely encoded. The secret is needed to verify the signature, never to read the contents, which is why confidential data does not belong in a claim.
Questions about ToolsVerse itself — privacy, cost, what happens to your files — are answered in the frequently asked questions.
Related tools
The tools people most often need alongside JWT Inspector.
Can’t find the tool you need?
Tell us what you’re looking for and we’ll consider adding it.