JWT Inspector

Decode a three-part signed JWT (compact JWS). Header and payload are shown together; numeric and string tokens retain their original spelling. Decoding does not check a signature. The example contains only public demonstration data. The JSON buttons copy the exact displayed header or payload, including preserved number and escape spellings. Clipboard failure leaves the decoded data available.

In Signature, explicitly choose the algorithm you expect and enter your key. HS256/384/512 accept exact UTF-8 text (spaces are significant), unpadded base64url or hexadecimal byte pairs. RS256/384/512, PS256/384/512 and ES256/384/512 use a SPKI BEGIN PUBLIC KEY PEM, not a certificate or private key. RSA keys must have at least 2048 bits. ECDSA signatures use the JWT raw R||S format. HMAC secret strength is not assessed.

A match means only that the signature fits the selected key. Issuer trust, intended audience, required claims, revocation and your application rules are not checked. Unsigned tokens, algorithm mismatches and critical JOSE extensions cannot pass verification here. No key URLs or embedded keys are fetched or used.

Time claims are inspected independently: exp is expired at equality, nbf active at equality; future iat is shown explicitly. Non-numeric or out-of-range values are flagged. An empty reference field captures the current time when decoding or pressing Now; it does not tick automatically. Input time is local; results show UTC. NumericDate arithmetic uses JavaScript numbers and millisecond dates.

Limits: 262,144 token characters, 65,536 decoded bytes per JSON part and 65,536 key characters. Strict unpadded canonical base64url, fatal UTF-8 and JSON objects; duplicate names are rejected, nesting is limited to 128. Five-second verification deadline and Cancel discard results; Web Crypto operations themselves cannot be aborted. Token edits invalidate decoded output; key or algorithm edits invalidate signature results. No encrypted JWE, detached or unencoded payloads.

No token or key is saved in cookies or browser storage or uploaded by this tool. Token text stays in page memory across tool switches; the key field is cleared when leaving. References: JWT, JWS and JWT best practices.