JWT Inspector Online
Decode and inspect JWT tokens. View all claims with expiry detection and timestamp formatting.
When a JWT inspector is the right tool
Use this page to decode a compact JWT and read every header and payload claim in a table, with a color-coded token and a simple exp badge. Paste a token or click Load Sample; the view updates as you type. “Expires in …” is not a cryptographic judgment — the signature is never checked. For a time-window-focused view, use JWT Expiry Checker; for another decode layout, use JWT Decoder.
Use cases
Reading all claims, including custom ones
Unlike the expiry checker’s short registered-claim list, this table shows every key. Load Sample includes name as well as sub, iat, and exp. Copy on each card gives you the full JSON.
Checking whether exp is in the past
If exp is a number, a badge appears on the payload card. The sample token uses exp 9999999999 (20 November 2286 UTC), so it shows a green “Expires in …” label measured in hours. A missing exp means no badge, not “no expiry” text. nbf is not considered.
Looking at the raw signature
The third segment is shown in full, with the note that verification requires the secret (or a public key) and is not performed here. The famous jwt.io-style signature on the sample is displayed as-is and is not checked against a key.
How inspection works
The token is trimmed and split into three parts. Header and payload are base64url-decoded (with a UTF-8 percent-encoding path and an atob fallback) and parsed as JSON. Time claims are converted with new Date(value * 1000).toISOString(). The color-coded line under the textarea is a simple split on dots and is shown whenever the box is not empty.
Load Sample decodes to:
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022,"exp":9999999999}
iat is shown as 2018-01-18T01:30:22.000Z (1516239022)
exp is shown as 2286-11-20T17:46:39.000Z (9999999999)
Expiry badge: “Expires in …” with hours (no days unit)
The signature segment is displayed only; it is not verified.The ISO timestamps are always UTC. They will not match a local-time reading of the same Unix value.
What this tool does not do
It does not verify HMAC or public-key signatures, honor nbf in the status badge, or express remaining time in days. Nothing is uploaded. To mint a new HS256 token, use JWT Generator.
How to use JWT Inspector
- Paste a compact JWT, or click Load Sample.
- Read the color-coded token, then the header and payload tables and the signature block.
- Copy the header or payload JSON if you need it, or Clear to empty the input.
Frequently asked questions
Does this page verify the JWT signature?
No. The page states that “Signature verification requires the secret key and is not performed in the browser.” It only base64url-decodes the header and payload and displays the third segment as text. A forged token with a far-future exp will still show as not expired. JWT Decoder also does not verify the signature; JWT Expiry Checker is a time-window check only.
How is expiry status decided?
Only a numeric exp claim is used. If exp is in the past, you see “Expired Xs ago”, “Expired Xm ago”, or “Expired Xh ago.” If it is in the future, “Expires in Xs/m/h.” There is no days unit, so a token that expires in years is shown in hours. nbf and iat are formatted as timestamps when present, but they do not affect the badge. A missing or non-numeric exp hides the badge entirely.
How are claims displayed?
Every key in the header and payload is listed. exp, iat, and nbf that are numbers are shown as a UTC ISO-8601 string plus the raw numeric value, for example 2018-01-18T01:30:22.000Z (1516239022). Other values are JSON.stringify’d, so strings appear with quotes. Copy writes pretty-printed JSON for the header or the payload.
What counts as an invalid token?
The input is trimmed and split on “.”. It must have exactly three parts, and the first two must base64url-decode to JSON. Otherwise you see “Invalid JWT — token must have 3 parts separated by dots.” (The same message is used when the part count is right but the JSON is not.) A color-coded split of whatever segments are present is shown as you type, even when the token is invalid. Load Sample pastes a fixed demo token; Clear empties the box.
Is my token sent to a server?
No. Decoding runs in your browser. A JWT can still be a credential: do not paste a production access token if you would not be comfortable with it sitting in memory on this device. Closing the tab discards it.
Related tools and guides
References
- RFC 7519 defines
exp,nbf, andiatas NumericDate values (seconds since the Unix epoch). This page formats those three keys as UTC ISO timestamps when they are JSON numbers. - Inspecting a token is not the same as accepting it. A server must still verify the signature and any audience or issuer constraints.