Skip to content
/web local tool
Suggest an improvement

Inspect and Decode a JWT Locally

Read header, payload, time claims and policy mismatches without uploading the compact token. Decoding never proves authenticity.

  • Decode-only: no signature trust implied
  • exp, nbf, iat, iss and aud diagnostics
  • No jku or x5u network fetches
Inspect a JWTRead the local inspection workflow
Local execution receiptinput path disclosedTool content stays out of MonoTools URLs and API requests.
Working input
Browser memory
Cross-tool handoff
Session only · 10 min
URL payload
Never
Export
Explicit action

Verify it: open DevTools Network, clear the log, use the tool, then inspect fetch/XHR requests. Page assets and optional aggregate analytics may use the network; tool input is not included.

Full privacy model
Loading tool...
01

How to use

  1. 01Paste only the three-segment compact JWT, without a Bearer prefix.
  2. 02Keep the trust and signature cards separate, then configure optional issuer, audience, expiration and clock-tolerance checks.
  3. 03Review header and claim findings, copy the token-omitting report, or use a session-only handoff for verification and time analysis.
02

FAQ

Does a clean report mean the JWT is valid?
No. A clean report only means the readable structure and configured claim checks passed. JWT Decoder does not verify the signature or application authorization.
Can this tool inspect exp, iss and aud?
Yes. It reads NumericDate claims, issuer and audience values, then compares them with the expectations you enter. These checks remain independent from signature verification.
How do I verify the JWT signature?
Use the session-only JWT Lab handoff and choose an explicit HS256 or supplied-public-key workflow, or verify in backend code with issuer-trusted keys and an enforced expected algorithm.
Does JWT Decoder fetch jku, x5u or JWKS URLs?
No. Remote key references are shown as warnings and are never requested. Fetching key material requires a separate allowlisted issuer policy.
Is the JWT added to the URL or report?
No. The compact token and signature bytes are omitted from reports and copied URLs. Session handoff is one-time and expires, but the browser tab still receives the pasted credential.
guides

Guides

Authentication debugging6 min read

How to Inspect a JWT Locally Without Uploading It

Read JWT header and payload claims locally, check exp, iss and aud, and learn why decoding is not the same as signature verification.

Read guide →
03

Related tools