JWT Decoder
Decode and inspect JSON Web Tokens
About the JWT Claim Inspector
This tool inspects JWT claims from a security perspective: expiry and issued-at times, issuer, audience and the signing algorithm — the fields that reveal a token which will never expire or was never really signed.
Inspecting JWT claims is a security review rather than a decode. The registered claims each carry a check: exp bounds how long a stolen token stays useful, iss and aud confirm the token was issued by and for the right parties, and iat shows when it was minted.
Two findings matter most. A token with no exp claim never expires, so anyone who obtains it has permanent access — there is no revocation for a stateless JWT. And an alg header of "none" means the token is unsigned, which historically let attackers forge tokens against libraries that accepted it.
Also worth remembering: a JWT payload is only Base64-encoded, so anyone holding the token can read every claim in it. Tokens must never carry secrets or personal data you would not put in a URL. For a plain decode of header and payload, the utilities JWT decoder is the simpler page.
How to use the JWT Claim Inspector
- Paste the token. Enter the full JWT, all three segments.
- Check the algorithm. Confirm the alg header is a real algorithm and not "none".
- Check the expiry. Look for an exp claim, and how far in the future it is.
- Verify issuer and audience. Confirm iss and aud match what your service expects.
JWT Claim Inspector features
- Registered claim inspection: exp, iat, nbf, iss, aud, sub, jti
- Flags a missing expiry claim
- Shows the signing algorithm from the header
- Timestamps converted to readable dates
- Notes that payloads are readable by anyone
- Runs entirely in your browser
Frequently asked questions
Why does a missing exp claim matter?
The token never expires, so anyone who obtains it has permanent access. A stateless JWT cannot be revoked.
What is the alg none problem?
An alg header of "none" means the token is unsigned. Libraries that accepted it allowed attackers to forge tokens freely.
Can I put private data in a JWT?
No. The payload is only Base64-encoded, so anyone holding the token can read every claim.
Does this verify the signature?
No. Verification needs the signing key. This inspects the claims and flags structural problems.
How is this different from the utilities JWT decoder?
That one decodes header and payload. This one reviews the claims for security problems.