What is a JWT?
A JSON Web Token is a compact format for carrying claims between systems. Most signed JWTs are readable without a key.
JWT Inspector
Decode and inspect JSON Web Tokens directly in your browser.
Your token stays in your browser.
Paste a JWT to inspect it.
Header
Encoded header
Payload
Encoded payload
Signature
Verify Signature
Verification is separate from decoding and runs only in this browser.
Header
Payload
Signing secret
Used only in your browser to sign this JWT.
Encoded JWT
Decoding does not verify a JWT. Anyone can read the header and payload of a normal signed JWT. Signature verification requires the secret or public key used by the issuer. Do not treat decoded contents as trusted until verification succeeds.
What does a JWT inspector do?
It Base64URL-decodes the header and payload so you can inspect their JSON values.
Can inspection verify a JWT?
No. Verification checks the signature with the issuer's secret or public key.
Is it safe to paste a JWT here?
This tool processes data locally and does not store it, but production credentials should still be handled carefully.
What are the three parts of a JWT?
header.payload.signature: the algorithm metadata, claims, and integrity check.