JWT Inspector
Decode a JWT and audit its claims for common issues.
About the JWT Inspector
Decode a JSON Web Token's header and payload locally, and flag common risks like alg:none, a missing signature, missing or long-lived exp, and missing aud/iss claims. This does not verify cryptographic signatures.
Examples
Decode a token
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.abcOutput
JSON{"sub":"123"}Keyboard shortcuts
- Copy the main outputCtrl / ⌘ + Shift + C
- Download the resultCtrl / ⌘ + S
- Share this toolCtrl / ⌘ + Shift + S
- Reset the inputsAlt + R
- Open the tool search paletteCtrl / ⌘ + K
Related tools
Htpasswd Generator
Security
Generate .htpasswd lines using SHA-1 or plain text.
Password Policy Generator
Security
Generate password policy rules, regex and copy for NIST or PCI presets.
Password Strength Checker
Security
Estimate password entropy, crack time, and get actionable advice.
TOTP Generator
Security
Generate time-based one-time passcodes from a Base32 secret.
JWT Decoder
Encoders & Crypto
Decode a JWT's header and payload, and check expiry.
CORS Config Generator
Security
Generate CORS headers/config for Nginx, Apache, Express, or Workers.
Frequently asked questions
Read more
- Understanding JWT: structure, claims and safe verification
What is actually inside a JSON Web Token, which claims matter, and why decoding a JWT is not the same as verifying it.
Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser