JWT Decoder & Inspector
Decode and inspect JWT tokens in your browser. View header, payload, timestamps, and claim details instantly with a clean developer-friendly JWT inspector.
Local-only decoding. This tool does not verify signatures and does not upload your token.
JWT anatomy, visually
Example token structure
Header
Algorithm and token type (e.g. HS256, JWT).
Payload
Claims like user id, role, audience, and expiration.
Signature
Integrity protection for header + payload.
JWT bugs are often hidden in claims, not code. This inspector highlights the exact token content so you can quickly answer: “Is this user really authorized?” or “Why is this token already expired?”
Common claims and what they mean
exp: Expiration time. If current time > exp, token should be rejected.
iat: Issued-at timestamp. Helps diagnose clock drift.
nbf: Not-before time. Token is invalid before this.
aud, iss, sub: Audience, issuer, and subject identity.
Practical debugging checklist
- Confirm token has exactly 3 dot-separated parts.
- Check if algorithm in header matches your backend expectation.
- Compare exp/iat/nbf against server time and timezone settings.
- Verify aud and iss values match your API gateway config.
- Inspect role/scope claims before debugging authorization middleware.