Go Toolstack

JWT Token Decoder & Header Inspector

Inspect JSON Web Tokens, parse claims payloads, and verify expiration dates.

JWT Token Decoder & Header Inspector

Inspect JSON Web Tokens, parse claims payloads, and verify expiration dates.

How It Works

1
Enter or Paste Text
Type or paste your text, code, or data directly into the input workspace.
2
Apply Transformation
Run the tool to convert, filter, format, or inspect your text content.
3
Copy Output
Copy the clean processed output to your clipboard with a single click.

Discover more client side utilities in this category

Developer Hub • Workflows & Comparison Guide

Explore all developer tools, browser limits, and intent selection guide.

Explore Hub →
JSON Formatter, Validator & Prettifier

Format, minify, and validate JSON data with lossless 64-bit precision and JSON Schema (Draft-07 / 2020-12) rules.
Base64 Encoder & Decoder

Encode plain text to Base64 or decode Base64 strings back to UTF-8 instantly.
SQL Query Formatter & Beautifier

Beautify complex SQL queries across PostgreSQL, MySQL, and standard ANSI dialects.

Related Practical Guides

Technical guides, troubleshooting, and best practice walkthroughs

Concept & Knowledge Hub

JWT Decoder & Verifier, Header & Payload Inspector, HMAC-SHA256 Signature Checker

JSON Web Tokens (JWT) provide stateless, cryptographically signed authentication tokens across modern web applications, microservices, and OAuth 2.0 / OpenID Connect authorization flows. The JWT Inspector decodes the standard three-part token structure (Header, Payload, Signature) into readable JSON, verifies claim expiration timestamps, and tests HMAC-SHA256 signatures directly within browser memory.

A security engineer investigates an expired authentication token received from a mobile client: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfNDkyMSIsInJvbGVzIjpbImFkbWluIiwiZWRpdG9yIl0sImlhdCI6MTczNTcwODgwMCwiZXhwIjoxNzM1NzEyNDAwfQ.example_sig. Pasting the token decodes the Header (specifying algorithm HS256) and reveals Payload claims: Subject usr_4921, permissions array ["admin", "editor"], and an exp claim of 1735712400. The tool evaluates the timestamp against current system time, flagging the token as expired. Entering the shared HMAC secret key in the verification field triggers client-side signature computation via the Web Crypto API, confirming whether the cryptographic signature matches the header and payload payload.

Token parsing and cryptographic verification utilize native Web Cryptography primitives (crypto.subtle.verify), ensuring sensitive enterprise credentials and secrets remain strictly client-side.

Core Architecture & Mathematical Formula

JWT = Base64URL(Header) . Base64URL(Payload) . Base64URL(Signature) ; Signature = HMAC-SHA256(Header.Payload, Secret)

Validates the three-part dot-delimited compact serialization format; decodes Base64URL byte arrays and recalculates HMAC signatures using SubtleCrypto.

Best Practices & Essential Guidelines

  • Always Inspect the Algorithm Header for 'none' Vulnerabilities: Verify that incoming JWTs enforce expected algorithms (e.g. HS256, RS256) and reject insecure 'alg': 'none' header manipulations.
  • Check the 'exp' (Expiration Time) Claim on Every Validation: Stateless JWTs cannot be revoked without token blacklisting; ensure client tokens carry short lifespans (e.g. 15 minutes) supplemented by secure refresh tokens.
  • Avoid Storing Confidential Secrets in JWT Payloads: Because JWT payloads are Base64URL-encoded rather than encrypted, anyone who inspects the token can read payload claims; never store raw passwords or unencrypted PII.
  • Verify Signature Integrity Before Trusting Payload Claims: Never grant user permissions or administrative access based solely on decoded payload JSON without cryptographically verifying the signature against your secret or public key.

Frequently Asked Questions (FAQ)

What is the difference between a decoded JWT and an encrypted JWT (JWE)?
A standard JWT (JWS) is signed to guarantee integrity, but its payload is merely Base64URL-encoded and publicly readable. An encrypted JWT (JWE) encrypts the payload content, making it unreadable without the corresponding decryption key.
How does the in-browser signature verification work?
The tool uses the browser's native Web Crypto API (SubtleCrypto) to generate an HMAC-SHA256 hash of the header and payload using your entered secret, comparing it against the token's existing signature.
What do the standard claims 'sub', 'iat', and 'exp' represent?
'sub' (Subject) identifies the user ID or principal; 'iat' (Issued At) records the Unix timestamp when the token was created; 'exp' (Expiration Time) defines the timestamp after which the token is invalid.
Can I decode a JWT without knowing the secret signing key?
Yes. Decoding a token simply reverses Base64URL encoding into readable text. However, you cannot verify whether the token was genuinely created by your authentication server without the secret or public key.