JWT Decoder & Inspector

Decode and inspect JWT tokens with claims validation

JSON Web Token (JWT) is a proposed Internet standard for creating data access tokens. Our JWT Decoder parses header parameters and claim payloads instantly.

How to use JWT Decoder & Inspector

  1. Paste Token. Paste your raw encoded JWT string.
  2. Analyze claims. Review standard issued, expiry dates, and scopes.

Features

  • Offline Processing: Computes operations instantly in your local browser client.
  • One-Click Copy: Instantly copy inputs or outputs to your clipboard.
  • Precision Outputs: Processes inputs immediately to provide clean, error-free results.

Why use this tool

  • Client-Side Safety: Never sends access tokens to external APIs.
  • Clean Formats: Decodes header, claims payload, and signature blocks separately.

Frequently asked questions

How do I decode a JWT?

Paste the token, which has three parts separated by dots, and the tool shows the decoded header and payload as JSON. A JWT is just Base64URL text, so decoding needs no key. The third part is the signature and cannot be read as JSON.

Does decoding a JWT verify its signature?

No. Decoding only reveals the header and payload, which anyone can read. Verifying needs the secret or public key on your server and must be done there before you trust any claim. A token that decodes fine may still be forged or tampered with.

What are the three parts of a JSON Web Token?

A JWT is header.payload.signature. The header states the token type and signing algorithm such as HS256, the payload holds claims like sub, name and exp, and the signature is computed over the first two parts using a secret or private key.

What do exp, iat and nbf mean in a JWT?

They are registered claims holding Unix timestamps in seconds. exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. For example, iat 1516239022 is 2018-01-18 01:30:22 UTC.

Why does my JWT show as invalid?

The tool expects exactly three dot-separated parts whose first two decode to valid text. Common problems are a missing part, a copied Bearer prefix or quotation marks, line breaks in the middle, and truncated tokens. Remove the word Bearer and any extra characters, then paste again.

Is a JWT encrypted?

A normal signed JWT (JWS) is not encrypted. Its payload is only Base64URL encoded, so anyone holding the token can read it. Do not put passwords or private data in the claims. Encrypted tokens (JWE) exist but have a different five-part format that this tool does not decode.

Is it safe to decode secret keys online?

With Toolskyt, it is 100% safe. All token decoding occurs client-side in your tab; we never log or inspect tokens.

Can I verify the signature?

Yes, our inspector validates structure signatures and validates signatures algorithm parameters.

Is my data shared when using the JWT Decoder & Inspector?

No. Toolskyt operates under a zero-server policy. All calculations, data formatting, and file exports are executed locally on your machine.

Do I need to sign up or pay to use the JWT Decoder & Inspector?

No, this tool is 100% free. There are no limits, sign-ups, subscriptions, or hidden charges required.

Related tools