JWT Decoder and Claims Inspector
Decode a compact three part JSON Web Token to inspect its header and claims, then compare time claims with the current clock. Decoding does not verify a signature or establish trust.
How the JWT inspector works
A compact signed JWT has three Base64url parts separated by periods: a JSON header, a JSON payload of claims, and a signature segment. This tool decodes the header and payload as UTF 8 JSON objects. It does not verify the signature, issuer, audience, permissions, or authorization.
Enter a compact three part token. The decoded header and payload appear as formatted JSON, and the claims table shows common claims such as iss, sub, aud, exp, iat, and nbf. Five part encrypted tokens are outside this tool's supported input. Their protected header may be readable JSON, but the encrypted claims payload cannot be inspected without decryption.
NumericDate values in exp, iat, and nbf are interpreted as seconds since the UTC epoch, including fractional seconds. The expiration and not before times are compared with the clock when the page is open. Missing and malformed dates are reported separately. These time comparisons do not validate the token or its claims.
A signature segment marked present only means the third part contains text. The tool does not check its cryptographic value, algorithm, signing key, or issuer. Treat all decoded claims as untrusted until the token is verified by the service that issued it.
Step by step
- Paste a compact three part JWT into the token field.
- Inspect the decoded header, payload, signature segment, and displayed claims.
- Compare exp and nbf times with the displayed clock, then verify the token with the expected trusted key and rules before relying on it.
Worked example
Paste this sample token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlIiwic3ViIjoidXNlci0xMjMiLCJhdWQiOiJhcGkuZXhhbXBsZSIsImV4cCI6MTg5MzQ1NjAwMCwiaWF0IjoxODkzNDUyNDAwLCJuYmYiOjE4OTM0NTI0MDB9.c2ln. It decodes to a header with alg HS256 and typ JWT and claims for issuer, subject, audience, expiration, issued at, and not before.
The example has a nonempty third segment, so the display reports that signature text is present. It does not verify that signature. exp is 00:00 UTC on January 1, 2030; iat and nbf are 23:00 UTC on December 31, 2029. The displayed comparisons depend on the current clock.
When to use this inspector
Use it to view the JSON header and claims payload of a three part compact token during development or troubleshooting.
Use a separate trusted service to verify signatures and authorization. Treat decoded content as untrusted until those checks succeed.
Common interpretation errors
Do not treat readable JSON, a present signature segment, or an unexpired exp claim as proof of authenticity. Decoding and time comparison are not cryptographic verification.
Do not assume that claims such as iss, aud, sub, or custom permissions are true because they appear in the payload. A service must verify the signature and apply its own claim and authorization rules.
JWT structure and time claims
Compact JWT = Base64url(UTF8(header JSON)) . Base64url(UTF8(payload JSON)) . signature segment
Expiration has passed = current UTC time in seconds ≥ exp
Not before time reached = current UTC time in seconds ≥ nbf
NumericDate = seconds since 1970 01 01 00:00:00 UTC
This tool inspects the three part compact signed form. It strictly decodes unpadded Base64url and UTF 8, and requires the header and payload to be JSON objects. A displayed expiration or not before result is a clock comparison only, not signature verification or an authentication decision.
Scope and limitations
This page inspects a three part compact JWT and decodes its header and payload. It does not verify signatures, validate algorithms or keys, confirm issuer or audience, evaluate permissions, or determine whether an application should accept the token. It does not decrypt five part JWE tokens, fetch keys, call an issuer, or contact a token service. JSON numbers outside supported numeric precision are rejected, and displayed dates have millisecond precision. Time claims are compared with the browser clock and may differ from a service clock. The token is not saved by this tool, but anyone with access to the open page can view it.
Key terms
- JWT
- A JSON Web Token that represents claims in a signed, integrity protected, or encrypted structure.
- Claim
- A named value in the token payload, such as an issuer, subject, audience, or time value.
- NumericDate
- A number of seconds since 1970 01 01 00:00:00 UTC. Fractional seconds are permitted.
FAQ
Does a decoded token count as valid?
No. Decoding shows readable structure only. It does not establish that the token was issued by a trusted service or that its contents can be trusted.
Does the tool verify the signature?
No. It only reports whether the third segment contains text. A verifier must use the expected algorithm and a key it trusts for the token issuer.
Why are five part tokens unsupported?
A five part compact JWE can have a protected header that is readable as JSON. Its encrypted payload cannot be inspected as claims without decryption. This tool supports only three part compact JWTs.
What do exp, iat, and nbf mean here?
They are NumericDate claims expressed in seconds since the UTC epoch. The tool compares exp and nbf with the current clock and displays iat as a date. Missing or malformed values are shown separately. These comparisons do not validate a token.
What does a present signature segment prove?
Only that the third part is not empty. The tool does not verify the signature bytes, signing algorithm, key, issuer, audience, or permissions.
Related tools
The Base64 Payload Encoder can inspect individual encoded parts. Use your identity provider or service documentation to verify token signatures and claim requirements.