JWT Inspector
Decode a JWT and audit its claims for common issues.
About the JWT Inspector
Decode a JSON Web Token's header and payload locally, and flag common risks like alg:none, a missing signature, missing or long-lived exp, and missing aud/iss claims. This does not verify cryptographic signatures.
Popular uses
- jwt
- json web token
- decode
- claims
- auth
Examples
Decode a token
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.abcOutput
JSON{"sub":"123"}Keyboard shortcuts
- Copy the main outputCtrl / ⌘ + Shift + C
- Download the resultCtrl / ⌘ + S
- Share this toolCtrl / ⌘ + Shift + S
- Reset the inputsAlt + R
- Open the tool search paletteCtrl / ⌘ + K
Related tools
Htpasswd Generator
Security
Generate .htpasswd lines using SHA-1 or plain text.
Password Policy Generator
Security
Generate password policy rules, regex and copy for NIST or PCI presets.
Password Strength Checker
Security
Estimate password entropy, crack time, and get actionable advice.
TOTP Generator
Security
Generate time-based one-time passcodes from a Base32 secret.
JWT Decoder
Encoders & Crypto
Decode a JWT's header and payload, and check expiry.
CORS Config Generator
Security
Generate CORS headers/config for Nginx, Apache, Express, or Workers.
Works well with
Next steps from other categories.
JWT Encoder
Encoders & Crypto
Build and sign a JWT with HS256/384/512 from a header, payload, and secret.
Base32 Encoder
Encoders & Crypto
Encode or decode text using RFC 4648 Base32.
Base64 Encoder
Encoders & Crypto
Encode or decode text to/from Base64, UTF-8 safe.
HTML Entity Encoder
Encoders & Crypto
Encode or decode HTML entities in text.
Frequently asked questions
Read more
- Understanding JWT: structure, claims and safe verification
What is actually inside a JSON Web Token, which claims matter, and why decoding a JWT is not the same as verifying it.
Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser