JWT Token Inspector
How to use
Decodes JWT tokens, the tokens used for logins and APIs, so you can see what is inside them. It splits the token into its header, payload and signature and shows them separately. Paste your JWT and it is decoded, letting you inspect the claims and check the expiry time.
Decoded header appears here…Decoded payload appears here…- Debugging an API 401 error by checking a token's expiry and issuer claims
- Inspecting custom claims added to a JWT during a login flow implementation
- Verifying an access token contains the expected scopes before troubleshooting an authorization bug
- Checking whether a token from a support ticket has simply expired
Free and private. Everything runs on your own device, with no account and no uploads.
When an API call fails with an authorization error, developers often need to inspect the claims inside a JWT to see the expiry time, issuer or user data without writing a script. This tool splits a JSON Web Token into its header, payload and signature, decodes the header and payload from Base64URL, and flags whether the token has expired, making it easy to debug login and API auth issues.
No, it only decodes the header and payload from Base64URL to show their contents; it does not verify the signature against a secret or public key, so a decoded token could still be forged or tampered with.
It compares the "exp" claim, a Unix timestamp, against the current time on your device, and flags the token as expired if that time has passed.
Yes, since decoding does not require the signing key, it works the same way regardless of which signing algorithm was used.
- 1
Paste the JWT
Add the full token string, including all three dot-separated parts.
- 2
View the decoded header and payload
The tool decodes and displays the header and payload as readable JSON.
- 3
Check the expiry status
Look at the highlighted exp claim to see if the token is expired.
- 4
Inspect specific claims
Review individual claims like sub, iat and custom fields.
- ·This only decodes the token, it does not verify the signature, never treat the displayed claims as proof of authenticity.
- ·Compare the "exp" claim against the current time in the token's own timezone context, since it is a Unix timestamp evaluated against your device clock.
- ·Because tokens can contain sensitive data, avoid pasting production tokens into any tool you do not fully trust, this one processes everything locally.