JWT Inspector
API & BackendDecode a token and audit its claims, expiry and signature settings.
Runs entirely in your browser — nothing is uploaded
What people do next
Features
- Security audit covering alg: none, weak algorithms and missing claims.
- Lifetime analysis with warnings for over-long expiry windows.
- Every registered claim explained in plain English.
- Optional signature verification when you supply the secret.
How to use the JWT Inspector
- 1Paste the token to inspect.
- 2Read the audit findings and claim table.
- 3Optionally enter the secret to verify the signature.
Frequently asked questions
What is the "alg: none" attack?
A forged token declares no algorithm and drops the signature. Servers that trust the header field accept it. Always pin the expected algorithm server-side.
Does this verify the signature?
No, and nothing running only in a browser can, because verification needs the signing secret or public key. This decodes and displays the claims. A token that looks perfectly valid here may be forged, expired or signed by the wrong key, so never use a client-side decode as an authorisation decision.
Is it safe to paste a real token in?
The decoding happens entirely in your browser and the token is never transmitted or stored. That said, a JWT is a bearer credential: anyone holding it can act as you until it expires. Treat pasting one anywhere with the same care as a password, and prefer an expired or test token when you can.
Why can anyone read the contents of my token?
Because a JWT is signed, not encrypted. The header and payload are ordinary base64url and are readable by anyone who holds the token. The signature proves the contents have not been altered, but it hides nothing, so never put anything confidential in a claim.