Can I inspect a JWT without the signing secret?

Yes. The header and payload are Base64URL-encoded, so they can be decoded without a secret. That reveals what the token claims, but it does not prove who signed it or whether the application should accept it.

How do I open and read a .jwt file locally?

A .jwt file is normally text. Open it locally, copy only the three-segment compact token, and paste it into JWT Decoder. The tool reads the pasted value in the browser tab and does not fetch the file.

How do I check whether a JWT is expired?

Read the exp claim as a NumericDate in seconds since the Unix epoch, then compare it with the current time and the application's allowed clock skew. Also check nbf and iat when the failure is time-related.

Why is decoding a JWT not the same as verifying it?

Anyone can construct readable header and payload segments. Verification must recompute the signature with the expected algorithm and issuer-trusted key material, then apply claim and authorization policy separately.

Is it safe to paste a production access token?

Treat a live access token as a credential. Prefer a synthetic or revoked token. MonoTools processes the pasted token locally, but if a production token has already crossed an untrusted boundary, rotate or revoke it.

Authentication debugging

How to Inspect a JWT Locally Without Uploading It

Read JWT header and payload claims locally, check exp, iss and aud, and learn why decoding is not the same as signature verification.

Header and payload decoded in this browser tab
exp, nbf, iat, iss and aud checked separately
Signature remains untrusted until verified with expected keys

Inspect a JWT locally

6 min readUpdated August 14, 2026

Treat a JWT like a credential

A JWT is normally readable, but it may still be a bearer credential that grants access to an API. Copying a live token into an unknown server-side decoder can expose it even when the page only appears to show its claims.

A safer inspection path keeps the compact token inside the current browser tab. Local decoding is enough to read the header and payload because those segments use Base64URL encoding, not encryption.

Prefer a test token when one is available.
Never post the original compact token in tickets or chat.
Rotate a production token if it has crossed an untrusted boundary.

Decode the structure before debugging claims

A JWT normally has three dot-separated segments: header, payload and signature. Decode the first two segments, parse them as JSON and check that the algorithm and token type match what the application expects.

Then inspect registered claims such as iss, aud, sub, exp, nbf and iat. Expiration failures are frequently caused by clock skew, mixed seconds and milliseconds, or a token issued for a different audience.

Check that exp and iat are numeric date values in seconds.
Compare iss and aud against the API configuration.
Review custom roles or scopes for unexpected privilege changes.

Decoding does not prove authenticity

Anyone can construct a header and payload. A decoder can explain what a token claims, but only signature verification can show whether a trusted issuer signed those exact bytes.

For focused local diagnosis, JWT Lab can verify HS256 with an expected shared secret or verify RS256 and ES256 against explicitly supplied public JWK, JWKS or PEM material. Production services should still use the issuer's supported backend library, trusted issuer configuration and managed key rotation. Always enforce the expected algorithm instead of trusting the alg value inside the token.

Use a repeatable local workflow

Start with JWT Decoder to inspect the structure and readable dates. Move to JWT Lab only when an explicit shared-secret or supplied-public-key signature check is appropriate, and use Timestamp Converter for deeper date comparisons.

Before sharing any diagnostic output, remove the original compact token and scan the remaining text for other credentials. A useful ticket contains the failing claim values and timestamps, not a reusable bearer token.

FAQ

Questions about JWT Decoder

Can I inspect a JWT without the signing secret?: Yes. The header and payload are Base64URL-encoded, so they can be decoded without a secret. That reveals what the token claims, but it does not prove who signed it or whether the application should accept it.
How do I open and read a .jwt file locally?: A .jwt file is normally text. Open it locally, copy only the three-segment compact token, and paste it into JWT Decoder. The tool reads the pasted value in the browser tab and does not fetch the file.
How do I check whether a JWT is expired?: Read the exp claim as a NumericDate in seconds since the Unix epoch, then compare it with the current time and the application's allowed clock skew. Also check nbf and iat when the failure is time-related.
Why is decoding a JWT not the same as verifying it?: Anyone can construct readable header and payload segments. Verification must recompute the signature with the expected algorithm and issuer-trusted key material, then apply claim and authorization policy separately.
Is it safe to paste a production access token?: Treat a live access token as a credential. Prefer a synthetic or revoked token. MonoTools processes the pasted token locally, but if a production token has already crossed an untrusted boundary, rotate or revoke it.

next step

Try this workflow

Start with JWT Decoder and review the result before sharing.

Inspect a JWT locally