Inspect JSON Web Token headers, payloads, and cryptographic signatures in real time directly in your browser.
All formatting, parsing, decoding, and validation executes entirely within your browser using modern Web APIs and JavaScript. Your tokens, JSON payloads, regex inputs, and queries never leave your computer.
JSON Web Tokens (RFC 7519) are standard compact URL-safe tokens commonly used for authentication headers, OAuth 2.0 access tokens, and OpenID Connect ID tokens. A typical JWT consists of three base64url-encoded parts separated by periods: the Header (specifying algorithm and token type), the Payload (containing claims like sub, exp, iss, and aud), and the Signature.
This tool parses the raw JWT string, base64url-decodes the JSON structures, and highlights token status including expiration date, issued-at timestamps, and custom claims. Because debugging authentication tokens involves sensitive identifiers and credentials, this utility executes entirely client-side without logging or transmitting token contents to any remote server.
No. All decoding and parsing takes place entirely within your browser using client-side JavaScript. Your tokens, secrets, and authorization headers never touch our servers.
This tool performs structural decoding and claim inspection. Because verifying signatures requires the server-side secret key or public certificate, signature validation should be conducted by your authorization server or backend gateway.
Common causes include an expired timestamp (exp), a clock skew issue before not-before (nbf), an audience mismatch (aud), or an unexpected signing algorithm (alg: HS256 vs RS256).
Base64url is a variant of Base64 where '+' is replaced by '-', '/' is replaced by '_', and trailing '=' padding characters are removed to make the token URL-safe.
Complete reference for standard registered claims: iss, sub, aud, exp, nbf, and iat.
Practical guide on calculating remaining JWT lifetime and preventing 401 token errors.
Understanding access tokens, refresh tokens, and bearer authentication in modern APIs.
Encode and decode raw strings and binary data with standard and URL-safe Base64.