What it does
Inspect claims such as iss, sub, aud, iat, nbf and exp while testing an integration. Reading the contents does not authorize access or replace server-side cryptographic verification.
When to use it
Use this workflow when the example below matches your task and the documented limits fit your input. Keep the original and review the output before sharing it.
Steps
- Paste a synthetic three-part compact JWT.
- Select Decode and inspect the header, payload and available UTC dates.
- Copy the JSON if needed, then reset to clear the contents.
Worked example
A payload containing exp: 0.
exp date: 1970-01-01T00:00:00.000Z; signature not verified.
Common mistakes and limitations
- Maximum 16 KiB; valid object JSON and UTF-8 required. Five-part JWE is unsupported.
- Does not validate signatures, algorithms, audiences or expiration for authorization. Avoid live tokens on untrusted devices.
Frequently asked questions
Is my input uploaded?
No. Processing runs in your browser. Visiting the site downloads public software and resources; this tool does not automatically save your input or results.
How do I check the result?
Start with the worked example, compare the output and use synthetic data before processing sensitive information. Downloaded files should be opened in an independent reader.