JWT inspector
Your result will appear here.
About JWT inspector
JWT Inspector decodes JWT tokens and displays the header and payload with additional analysis — including human-readable timestamps for iat, exp, and nbf claims. Useful for security review, token lifecycle debugging, and understanding token structure without exposing tokens to external services.
When to use JWT inspector
- Verify token expiry in human-readable UTC datetime instead of Unix timestamps
- Inspect all claims in an access, refresh, or ID token during OAuth debugging
- Confirm the signing algorithm (HS256, RS256, ES256) matches your security requirements
- Audit token payloads for excessive permissions or missing required claims
- Debug authentication errors by comparing the exp claim timestamp to current time
How it works
JWT Inspector decodes the header and payload segments using Base64URL decoding (with padding normalization and URL-safe character substitution), then JSON-parses each section. Timestamp claims — iat (issued at), exp (expiration), and nbf (not before) — are detected and displayed alongside their ISO 8601 UTC datetime equivalents. The signature is not cryptographically verified.
Privacy & security
JWT inspector runs entirely in your browser. No input data is uploaded to any server, stored in a database, or shared with third parties. You can use it offline once the page has loaded.
Frequently Asked Questions
Common questions about this tool.
Does JWT Inspector verify the signature? ▼
No. Signature verification requires the signing secret or public key, which should never be pasted into a browser tool. This tool reads and analyzes token content only. Use your server-side authentication library for signature verification.
What is the difference between JWT Inspector and JWT Debugger? ▼
Both tools decode JWT tokens and show header and payload. JWT Inspector adds human-readable timestamp display for iat, exp, and nbf claims. If you need to quickly read a timestamp claim without mental Unix timestamp conversion, JWT Inspector is the better choice.
What are the standard JWT claims I should always check? ▼
"sub" (subject — usually the user ID), "iss" (issuer — who created the token), "aud" (audience — intended recipient), "exp" (expiration Unix timestamp), "iat" (issued at Unix timestamp), "nbf" (not before — token is invalid before this time). Any additional claims are application-specific.
Is it safe to paste real JWTs here? ▼
JWT Inspector runs 100% locally in your browser — tokens are never sent to any server. As a best practice, use test tokens for debugging when possible and avoid pasting production tokens with sensitive claims into any browser tool.
Is JWT inspector free to use? ▼
Yes. JWT inspector is completely free and runs locally in your browser — no account required.
Does Nadhebe upload my data? ▼
No. All processing happens in your browser. Your input data never leaves your device or gets sent to any server.
Related Free Utilities
View all tools →Base64 encoder
Base64 encoder. Use this privacy-first base64 encoder directly in your browser.
URL parser
URL parser. Use this privacy-first url parser directly in your browser.
JWT debugger
JWT debugger. Use this privacy-first jwt debugger directly in your browser.
Json Validator
Browser native Json Validator utility.