Inspect Base64URL header and payload JSON, issued-at, not-before and expiry times in UTC and browser-local time. Decoding does not verify a JWT signature.
BROWSER-BASED DEVELOPER TOOL
Inspect a JWT header and payload as untrusted text, locally in your browser. Decoding does not verify its signature or authenticity.
Do not paste production credentials or sensitive tokens. Anyone with a token may be able to read its claims.
A JWT has three dot-separated Base64URL segments. This viewer never checks signing keys, issuer, audience or permissions.
iss issuer · sub subject · aud audience · iat issued at · nbf not before · exp expiry · jti token ID. All decoded claims are untrusted.
Tokens are never executed, uploaded, logged or stored by this tool. Signature verification is not performed.
Paste non-sensitive text or open a local CSV/JSON file; all processing stays in the browser.
Configure output or inspect unverified claims without sending your data anywhere.
Review text output, copy or download when available, then clear sensitive inputs.
Paste a non-sensitive JWT, decode locally and review its unverified header, payload and time claims. Copy decoded JSON, then reset. Never paste production credentials.
Strict JWT structure and UTF-8/Base64URL validation, UTC/local claim display, browser-clock expiry status and readable claim explanations without sending tokens anywhere.
JWT input is never uploaded, executed, logged or stored by this tool. It does not verify signatures, issuer or authenticity. Avoid production or sensitive tokens.
No. Decoded claims are untrusted. This viewer never verifies signing keys, issuer, audience, authenticity or permissions.
No. Decoding occurs only in your browser; the tool does not upload, store, log or execute token content.
No. Avoid production credentials, session tokens and other sensitive JWTs. Claims can be readable to anyone holding the token.
iat is issued-at time, nbf is not-before time, and exp is the expiration time. They are numeric seconds since the Unix epoch.
The browser compares exp and nbf to its local clock. This is a time hint only, never proof of token validity.
Malformed Base64URL/JSON or missing required segments are rejected; if exp is absent, the viewer reports that no expiry claim exists.