JWT Decoder & Claim Inspector
Inspect the readable parts of a JSON Web Token without sending it to a decoder service. See the header, payload and signature text, then interpret common time claims with an explicit reminder that decoding is not verification.
Browser-based · No account required · Copy and export
Workspace
PixelOkay · Developer toolsDecoded does not mean verified. This page does not verify signatures. Avoid using real production access tokens in shared browsers.
How to use JWT Decoder & Claim Inspector
- Paste a three-part compact JWT. Treat its contents as sensitive even when encoded.
- Decode and inspect the header and payload. Review exp, nbf and iat dates in the claim summary.
- Copy the payload or download the unverified inspection report. Clear the token and decoded fields when finished.
When to use this tool
Inspect token headers, payload fields and claim dates while debugging authentication. Decoded content is unverified; use the separate HS256 generator/verifier when that supported signature workflow is needed.
JWT claims are readable before they are trusted
Compact JWT header and payload segments commonly contain Base64URL-encoded JSON. NumericDate claims express seconds relative to the Unix epoch. An exp or nbf value can be displayed as a date without establishing that anyone trustworthy signed it. The signature segment is shown as text only. Applications must verify signatures and enforce their issuer, audience and authorization rules separately.
Worked example
Payload: {"sub":"sample","exp":1700000000}
exp UTC: 2023-11-14T22:13:20.000Z
Inspection report: signatureVerified = falseLimits and output checks
The tool decodes JSON objects, not encrypted JWE tokens or every JOSE serialization. No signature key is requested and no signature verification is performed. Numeric time claims must be finite numbers. A decoded token can be expired, forged or intended for a different application.
Reference: JWT registered claims.
Frequently asked questions
Does a readable token mean its signature is valid?
No. Anyone can construct readable header and payload segments. Decoding alone establishes no authenticity.
Are token contents secret because they are Base64URL?
No. Encoding is reversible. Avoid sharing access tokens or payloads that identify users or contain private data.
What does the report's signatureVerified field mean?
It is always false for this decoder. It records that signature verification was not performed, even if the time claims look current.
A practical workflow
Inspect a permitted sample token to understand its visible claim names and date fields. Use your application’s authentication system for acceptance decisions.
Read the scope alongside the result
Readable claims can be forged or expired. This decoder does not verify signatures, handle every JOSE form or establish that a token belongs to your application.