Skip to content
English
All tools

Categories

Developer ToolsEncoding & DecodingJSON & DataHash & ChecksumText ToolsDate & TimeNetwork ToolsFile ToolsMarkdown & Diagrams

JWT Inspector

Go beyond decoding: see every header parameter and claim explained, plus practical warnings about how the token is built.

Processed locally in your browser

The token is decoded locally and never sent anywhere. Decoding does not verify the signature.0 chars · 0 lines
The result will appear here.

What is JWT Inspector?

The inspector reads the header and payload and lists them in a table that separates registered claims (iss, sub, aud, exp, nbf, iat, jti), well-known OpenID and OAuth claims, header parameters and your own custom claims, each with a short description.

It then runs a checklist: whether the algorithm is “none” or symmetric HS256/384/512 versus asymmetric RS, PS, ES and EdDSA, a missing exp, a very long lifetime, an exp already in the past, an nbf in the future, an iat ahead of your clock, a kid to treat as untrusted input, and key-source headers like jku, x5u, jwk and x5c that a verifier must never follow blindly. It also reports the byte size of each segment.

How does it work?

  1. Paste the token; “Bearer ” prefixes and whitespace are tolerated.
  2. Read the status banner: the analysis is not verification, and the signature is never checked.
  3. Review the warnings first, then the claims table and the summary rows.
  4. Compare against your verifier’s configuration: pinned algorithm, expected issuer and audience, and maximum lifetime.

Common use cases

  • Reviewing tokens from a new identity provider before wiring up validation.
  • Spotting weak configurations such as no expiry, a one-year lifetime or alg none in test environments.
  • Understanding what each unfamiliar claim in an OIDC ID token means.
  • Preparing a security review checklist for an API that accepts bearer tokens.

Examples

Try this input in the tool above:

Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEyMzQiLCJuYW1lIjoiRGVtbyBVc2VyIiwiaXNzIjoiaHR0cHM6Ly9hdXRoLmV4YW1wbGUudGVzdCIsImF1ZCI6ImRlbW8tYXBwIiwiaWF0IjoxNzAwMDAwMDAwLCJuYmYiOjE3MDAwMDAwMDAsImV4cCI6MTkwMDAwMDAwMCwianRpIjoiZGVtby0wMDAxIn0.ZHVtbXktc2lnbmF0dXJlLW5vdC1hLXJlYWwtaG1hYw
Output
Algorithm: HS256 — HMAC (shared secret)
Token size: 291 characters
Header / payload / signature: 27 / 158 / 31 bytes
Claims in payload: 8
Lifetime (iat → exp): 2314 d 19 h 33 min
Time claims now: inside its time window
Signature (raw, NOT verified): ZHVtbXktc2lnbmF0dXJlLW5vdC1hLXJlYWwtaG1hYw (31 bytes)

Privacy

JWT Inspector runs entirely in your browser. The text or files you provide are processed on your device and are not uploaded, logged or stored on our servers.

Limitations

The findings are heuristics based on the token’s own contents. A token can pass every check here and still be forged, because the signature is not verified. There is no key guessing or cracking of any kind.

Frequently asked questions

What does the inspector check that the decoder does not?

The decoder shows the raw content. The inspector explains each claim, evaluates the algorithm family, the lifetime and time-claim consistency, and flags risky headers such as jku, x5u and jwk.

Why is alg “none” such a problem?

It means the token has no signature. A verifier that accepts it lets anyone craft a token with any claims. Real verifiers must pin the allowed algorithms and reject none.

Should the payload contain personal data?

Avoid it if possible. The payload is only encoded, so anyone who obtains the token can read every claim. Keep tokens short-lived and minimal.

Related tools

More tools in Developer Tools →