Skip to content
ITDWeb Security Platform
ITD
Search

JWT Decoder / Inspector

Decode a sample JWT’s header and payload locally and inspect settings and dates. Signature, issuer and audience are not verified, so this does not establish authenticity or actual validity. Do not paste a live login token or confidential data.

Everything runs in your browser. Your input is never sent to a server.

Use the tool

Sent
No (processed in your browser)
Stored
No (cleared on reload)
External API
None
Target
Connects to no outside target
Details
  • Your input is processed only in this page in your browser. It is not sent to this site's server or to any outside service.
  • Your input is not stored on a server or in browser storage. Closing or reloading the page clears it.
  • Loading the page itself is recorded in the access log (IP address, time, user agent, etc.). Tool pages do not load ads or analytics. Privacy policy

Use a sample or sanitized JWT above. Do not paste a live login token.

How to use

  1. 1

    Use a sample or sanitized token in three-part JWS form (header.payload.signature).

  2. 2

    Decode the header and payload and review the content findings; these are not authentication results.

  3. 3

    exp / iat / nbf are displayed in UTC. exp and nbf are compared with device time when the input changes, not continuously. Device clock errors affect this comparison.

Why it matters

This decoder reads Base64URL-encoded headers and payloads in three-part JWS form. Encrypted JWTs (JWE) are outside its scope. Reading claims does not verify their origin. Authentication must separately validate the signature or MAC, allowed algorithm, issuer, audience and applicable time rules. Do not put unnecessary secrets in tokens.

FAQ

QIs my JWT sent anywhere?
A

No. Decoding and content checks run locally in your browser; the token is not sent to a server. Use samples or sanitized data, not live login tokens or confidential content.

QIs the signature verified?
A

No. This only decodes and checks the displayed content. It does not verify the signature, issuer or audience, or establish authenticity or acceptance for authentication. Validate tokens separately using trusted keys and the application’s rules.

Related