JWT Inspector
Decode a JWT, read every claim with what it is for, and check the time claims against your clock — with nothing sent anywhere.
Everything on this page runs in your browser. Nothing you paste is uploaded, logged, or written into the URL — only the settings are, so a configured tool can still be linked to. A JWT is a credential for as long as it is valid. Nothing here is uploaded and nothing is put in the address bar.
The HS256 signature checks out against your secret, so these claims are as trustworthy as the secret is.
| field | value | what it is |
|---|---|---|
| alg | HS256 | the signature algorithm. Your verifier must pin this, not read it from the token. |
| typ | JWT | the token type, conventionally JWT. |
| kid | 2026-07-key-1 | which key signed it, so the verifier can pick the right one from a key set. |
| claim | value | what it is |
|---|---|---|
| iss | https://auth.example.com | who issued the token. Your verifier must check this — a correctly signed token from the wrong issuer is still the wrong token. |
| sub | user_8291 | who the token is about. Usually a user id, and usually the only claim you should key your own records on. |
| aud | api.example.com | who the token is for. If your API accepts a token whose audience is someone else's API, you have built a confused-deputy. |
| iat | 1785308400 | when it was issued. 2026-07-29T07:00:00.000Z (60 minutes ago) |
| exp | 1785313800 | expiry, in seconds since the epoch. Past this instant the token must be rejected. 2026-07-29T08:30:00.000Z (in 30 minutes) |
| jti | tok_4c19ab | a unique id for this token, which is what makes revocation lists and replay detection possible. |
| scope | read:invoices write:invoices | the permissions granted, space-separated. Check it; do not assume a valid token means an allowed action. |
| [email protected] | an identity claim, and personal data. It is readable by anyone holding the token. |
- Segments
- 3
- Total size
- 373 bytes
- Algorithm
- HS256
- Key id (kid)
- 2026-07-key-1
- Signature checked here
- yes — valid
- passthe HS256 signature is valid for the secret you typed
Base64 is not encryption, and this is the reminder
Every claim above is readable by anybody holding the token, including the browser storing it and any proxy that logs the header. The signature stops the claims being changed; it does not stop them being read. So an email address, a role list or an internal user id in a JWT is published data as far as the client is concerned, and a secret in one is a leaked secret. If the payload needs to be private, the token needs to be an opaque reference to server-side state, or a JWE — and a JWE is what the five-segment case above detects.
Three checks a verifier has to make and often does not
Pin the algorithm rather than reading it from the header, or a token that says alg: none — or one that says HS256 when you expected RS256, signed with your own public key as the HMAC secret — will be accepted. Check the audience, or a token minted for a different service by the same issuer will pass. Check the issuer against a fixed list, and never fetch keys from a URL the token itself supplies. All three are one line each, all three are omitted in most quick-start examples, and all three have their own CVE history.