JWT inspector
Your result will appear here.
About JWT inspector
JWT Inspector decodes JWT tokens and displays the header and payload with additional analysis — including human-readable timestamps for iat, exp, and nbf claims. Useful for security review, token lifecycle debugging, and understanding token structure without exposing tokens to external services.
When to use JWT inspector
- Verify token expiry in human-readable UTC datetime instead of Unix timestamps
- Inspect all claims in an access, refresh, or ID token during OAuth debugging
- Confirm the signing algorithm (HS256, RS256, ES256) matches your security requirements
- Audit token payloads for excessive permissions or missing required claims
- Debug authentication errors by comparing the exp claim timestamp to current time
How it works
JWT Inspector decodes the header and payload segments using Base64URL decoding (with padding normalization and URL-safe character substitution), then JSON-parses each section. Timestamp claims — iat (issued at), exp (expiration), and nbf (not before) — are detected and displayed alongside their ISO 8601 UTC datetime equivalents. The signature is not cryptographically verified.
Privacy & Security Guarantee
JWT inspector processes all data locally inside your web browser. No input text, files, credentials, or outputs are ever transmitted to remote servers, logged to analytics databases, or retained across sessions.
Frequently Asked Questions
Common questions about this tool.
Does JWT Inspector verify the signature? ▼
No. Signature verification requires the signing secret or public key, which should never be pasted into a browser tool. This tool reads and analyzes token content only. Use your server-side authentication library for signature verification.
What is the difference between JWT Inspector and JWT Debugger? ▼
Both tools decode JWT tokens and show header and payload. JWT Inspector adds human-readable timestamp display for iat, exp, and nbf claims. If you need to quickly read a timestamp claim without mental Unix timestamp conversion, JWT Inspector is the better choice.
What are the standard JWT claims I should always check? ▼
"sub" (subject — usually the user ID), "iss" (issuer — who created the token), "aud" (audience — intended recipient), "exp" (expiration Unix timestamp), "iat" (issued at Unix timestamp), "nbf" (not before — token is invalid before this time). Any additional claims are application-specific.
Is it safe to paste real JWTs here? ▼
JWT Inspector runs 100% locally in your browser — tokens are never sent to any server. As a best practice, use test tokens for debugging when possible and avoid pasting production tokens with sensitive claims into any browser tool.
Is JWT inspector free to use? ▼
Yes. JWT inspector is completely free and executes locally inside your web browser. No registration, API token, or software installation is required.
Is my input data uploaded to any server? ▼
No. Nadhebe utilities execute 100% client-side in your web browser. Your text, payloads, or files never leave your device.
Can I use this tool offline? ▼
Yes. Once the page is loaded in your browser, the JavaScript execution environment runs locally without needing an active internet connection.
Related Free Utilities
View all tools →Base64 encoder
Base64 encoder. Use this privacy-first base64 encoder directly in your browser.
URL parser
URL parser. Use this privacy-first url parser directly in your browser.
JWT debugger
JWT debugger. Use this privacy-first jwt debugger directly in your browser.
Json Validator
Browser native Json Validator utility.