JWT inspector
Read token headers, payloads and UTC timestamps without mistaking decoding for verification.
Inspection only — signatures are NOT verified. Claims can be forged. Use redacted or synthetic tokens, never a live bearer credential.
Accepts three-part compact JWS tokens with JSON objects. Optional Bearer prefix is removed. Five-part encrypted JWE and opaque API tokens are not supported. NumericDate claims use seconds, not milliseconds; expiry notes use your device clock at the time you click Inspect. This is not a JWT issuer, signature verifier or authentication service.
General input limit: 1,000,000 characters per field; AES uses the smaller limits stated above. SHA, HMAC, AES and RSA require HTTPS or localhost and browser Web Crypto. Inputs are processed locally, not stored by these tools or placed in the URL.
These pages do not load the site’s AdSense script. Browser extensions, compromised devices or scripts injected by hosting settings are outside the tool’s control. Use synthetic test data; a public website is not a secure key vault.
Technical references: Web Crypto API, JWT (RFC 7519), Base encodings (RFC 4648).