Inspect and debug JSON Web Tokens (JWT) in real-time. Unlike a simple decoder, the JWT Inspector allows you to edit header and payload properties directly to automatically generate new tokens, and verify signatures using cryptographic secret keys.
Key Features of JWT Inspector
- Claims Analysis & Highlights Instantly flags token expiration statuses, highlighting active or expired states with high contrast.
- Interactive Claims Editor Modify decoded payload keys or values inside the editor panel and review resulting payload structural layouts.
- Cryptographic Re-Signing Input custom secrets and securely recalculate compliant signature structures on your device.
- 100% Secure Sandbox Decoding, editing, and signature generation run purely client-side; no data leaves your machine.
JWT Inspector Examples
Verifying Token Lifespan
Inspect a token's temporal validity to see exactly when it will expire.
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZXhwIjoxNTE2MjM5MDIyfQ...Output
Token Status: Expired (Expired on January 18, 2018)How to Use JWT Inspector
-
1. Paste a JWT Token
Paste a JWT token into the input field to begin inspection.
-
2. Review Claims and Expiry
The inspector highlights the expiry time, issued-at date, and all payload claims with human-readable timestamps.
-
3. Copy Individual Fields
Click any field value to copy it directly to your clipboard.
Common Use Cases for JWT Inspector
- Debugging API Expiry Policies Confirm that issued tokens carry correct 'exp' times relative to server zone coordinates.
- Testing Form Input Variables Modify claims dynamically inside the sandbox to simulate different user scopes.
- Verifying Header Algorithms Inspect signing algorithms (such as HS256, RS256) to audit server configuration properties.
The Technical Details
The JWT Inspector integrates localized JavaScript decryption logic with interactive JSON schema maps. When a token string is inputted, the system splits, decodes, and parses the payload dictionary.
To verify signatures, the tool uses standard cryptography libraries inside the browser sandboxed environment. When you provide a secret key, the engine recalculates the HMAC hash of the header and payload segments, comparing the output string bytes directly against the signature portion of the original token.
Frequently Asked Questions
How does this differ from the JWT Decoder?
The JWT Inspector focuses on claims analysis: it highlights expiry status, formats timestamps, and flags expired tokens. The Decoder shows raw decoded JSON.
Does the tool check if the token is expired?
Yes. It compares the 'exp' claim against the current time and displays whether the token is still valid.
Is my token sent to a server?
No. All inspection runs locally in your browser with no network requests.
Which signing algorithms are supported?
The inspector handles any JWT regardless of algorithm (HS256, RS256, ES256, etc.) since it decodes the payload without verifying the signature.