العربية

JWT inspector

Decode a JWT header and payload locally to inspect their JSON, while keeping its signature explicitly unverified.

Processing is local with no automatic storage. Worker deadline: 5 seconds; complete result including details: 2 MiB. Preview is bounded; copy and download are complete.

Local header and payload decoding only: signature NOT VERIFIED. Its presence does not establish validity, trust or expiry. Do not enter private keys. Limit: 32,768 token units and 16,384 decoded bytes per segment; three unpadded Base64url segments and two JSON objects.

How to use

Paste the complete JWT and process it. Review the header, payload and unverified signature status. Copy or download the text result if needed; do not enter a private key.

Try an example

The synthetic token eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.c2ln shows alg as HS256 and sub as the string 123. The last segment is example bytes only, not evidence of a valid signature.

Support & limits

This inspects structure, not signature validity, expiration, issuer or claims. The header’s alg value is not proof of trust; verified remains false, including for a structurally accepted empty signature. JSON numeric lexemes are preserved without Number conversion, and invalid UTF-8 or JSON is rejected. Payload URLs are not opened, and external keys or addresses are not fetched.

Common questions

Does successful decoding make a JWT trustworthy for sign-in?

No. Decoding does not prove who created the token or that it has not changed. This tool does not perform the verification an authentication system requires.

Related tools

JSON formatter and validator

Format, minify and validate JSON while preserving large numbers and rejecting duplicate keys.

Base64 encoder and decoder

Encode local UTF-8 text or a file as Base64/Base64url, and decode to text or a file.

Text and file hash generator

Compute SHA-256, SHA-384 or SHA-512 for UTF-8 text or the exact bytes of a local file.