Zero upload · nothing leaves this tab
JWT Inspector
Paste a JSON Web Token to see its decoded header, every claim and an instant expiry verdict — decoded in your browser, never sent to a server.
Decode a token
Optional: check the signature and the algorithm
A secret typed here is fed only into your browser's WebCrypto HMAC — it is never uploaded, stored or logged.
Decoding happens locally in this tab. No token, claim or secret is uploaded, logged or sent anywhere.
Paste a JWT on the left — the verdict appears here.
Paste a token to see the decoded header.
How it works
The whole inspection runs locally in three steps — no request ever leaves the tab.
Drop the token straight out of a log or DevTools. A Bearer prefix and stray line breaks are stripped for you.
The three base64url segments are decoded as UTF-8 and printed as JSON, alongside a flat claim table with real dates.
An expiry badge humanises exp and nbf, while the algorithm and signature checks flag anything suspect.
What it checks
Valid with a humanised countdown, Expired with how long ago, Not yet valid, or No expiry claim — a string exp is coerced with a warning instead of being reported as expired.
HS256, HS384 and HS512 are recomputed with WebCrypto against a secret you type. A wrong secret reports a mismatch — never a green tick.
An expected-algorithm selector surfaces alg mismatches, and alg: none is called out as unsigned instead of silently passing.
Two-segment strings and opaque API keys get an inline error with the segment count. Non-JSON payloads fall back to raw decoded text.
Segments are decoded as UTF-8 bytes, so non-ASCII names, issuer strings and emoji survive intact.
No fetch, no XHR, no analytics. Paste a production token and watch DevTools stay silent.
FAQ
Is my token sent anywhere?
No. Decoding, expiry maths and the HMAC signature check all run in this tab with atob, TextDecoder, JSON.parse and WebCrypto. There is not a single network request on this page.
Can it verify RS256, ES256 or PS256 tokens?
Not the signature — those need the issuer's public key, which a zero-upload tool never has. The header and payload still decode exactly, and the verdict says so explicitly rather than pretending the token is valid.
Why does my token show "Not a JWT"?
A compact JWS has exactly two dots and three non-empty base64url segments. Session cookies, opaque access tokens and API keys do not, and this tool refuses to guess at a partial decode.
An expiry looks wrong — who do I trust?
Numeric date claims are seconds since the Unix epoch. The claim table prints each one as an ISO timestamp next to a humanised delta, so you can see at a glance which side of the comparison is skewed.
Latest updates
More free tools
Step-by-step guides in our blog & guides.