Decode and inspect JSON Web Tokens (JWT) locally. View header claims, payloads, and signatures.
The JWT Inspector is a high-performance utility designed to disassemble JSON Web Tokens into their constituent parts: the Header, the Payload, and the Signature. A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The tool operates by identifying the three segments separated by dots (.), applying Base64Url decoding to the first two segments, and parsing the resulting JSON strings into a human-readable format. Unlike standard Base64, Base64Url replaces + with - and / with _, and omits padding, which this inspector handles automatically to ensure data integrity.
Beyond simple decoding, the inspector provides critical validation checks. It analyzes the alg (algorithm) field in the header to determine if the token uses symmetric (HS256) or asymmetric (RS256) encryption. The tool specifically monitors for Registered Claim Names such as exp (expiration time), iat (issued at), and sub (subject). By comparing the exp timestamp against the current Unix epoch, the inspector provides a real-time status indicating whether the token is currently active or has expired, preventing authentication failures during development.
To use the JWT Inspector, paste your encoded token into the input field. The tool immediately triggers a parsing event. For developers integrating JWT logic into their own applications, understanding the programmatic flow is essential. For example, in a JavaScript environment, you can manually extract the payload using the following approach:
const base64UrlDecode = (str) => Buffer.from(str, 'base64').toString('utf-8');
const token = 'eyJhbGciOiJIUzI1...';
const payload = JSON.parse(base64UrlDecode(token.split('.')[1]));
console.log('User ID:', payload.sub);For those utilizing Python for backend validation, the PyJWT library is the industry standard:
import jwt
token = 'your_jwt_here'
secret = 'your_secret_key'
try:
decoded_payload = jwt.decode(token, secret, algorithms=['HS256'])
print(decoded_payload)
except jwt.ExpiredSignatureError:
print('Token has expired')typ and alg fields to ensure the token conforms to the expected security profile.Security is paramount when handling identity tokens. The JWT Inspector is designed as a client-side utility, meaning the decoding process happens entirely within your browser's memory. Your tokens are not transmitted to a remote server for parsing, which mitigates the risk of token interception. However, developers must adhere to the following security guidelines:
secret keys used for signature verification are stored in environment variables and never hardcoded in client-side scripts.A malformed token error typically occurs when the input does not follow the three-part structure (Header.Payload.Signature) separated by dots. This can happen if the token was truncated during a copy-paste operation or if the string contains illegal characters that are not URL-safe. Ensure you are pasting the entire string, including the trailing signature, and that no whitespace has been added to the beginning or end of the input.
The JWT Inspector performs decoding on the client side, meaning your data does not leave your browser. However, JWTs often contain sensitive claims or identity information that could be exploited if your screen is shared or your device is compromised. For production tokens, it is always recommended to use a local CLI tool or a trusted internal library to avoid exposing session tokens to any external web environment.
Decoding is the process of converting the Base64Url encoded segments back into a readable JSON format; this requires no secret key and can be done by anyone. Verifying, however, is the process of using a secret key or public certificate to cryptographically prove that the token was signed by a trusted source and has not been altered. This tool provides the decoding view, but verification requires the actual signing key to validate the signature hash.
The 'exp' (expiration) claim is a JSON numeric value representing the seconds since the Unix Epoch. The inspector extracts this value and compares it to the current system time to determine if the token is still valid. This is critical for developers to diagnose why a user is being unexpectedly logged out or why an API request is returning a 401 Unauthorized error despite the token being present.
No, this tool is specifically designed for JWS (JSON Web Signature) tokens, which are signed but not encrypted. JWE (JSON Web Encryption) tokens are fully encrypted and appear as a five-part string rather than a three-part string. To decode a JWE, you would need the private decryption key and a specialized decryption library, as the payload is not merely Base64 encoded but is cryptographically encrypted.