WaZappyJWT Inspector.
Paste a token to see its three parts in colour, the header and payload as formatted JSON, expiry times in plain dates and any security warnings. Decoding happens only in your browser.
Encoded token
Client-side only — your token is never sent to our servers.
Decoded
{}
{}
—
Claims explained
| Paste a token to see its claims. |
Security check
- Paste a token to check it.
How a JWT is built
A JSON Web Token has three Base64URL parts separated by dots: header (algorithm and type), payload (user data and claims such as exp and iat) and signature. Anyone can decode the first two parts — so never put passwords or secrets in a JWT. Only the server holding the key can verify the signature.
Frequently asked questions
Is it safe to paste my token here?
Decoding runs entirely in your browser with JavaScript; the token is not uploaded or stored. Still, avoid pasting live production tokens anywhere you do not control, and rotate any token you think was exposed.
Why is the signature not verified?
Verifying needs the secret (HS256) or the public key (RS256/ES256). This tool decodes and inspects the token; signature verification should happen on your server.
What do exp, iat and nbf mean?
exp is the expiry time, iat is when the token was issued and nbf is the time before which it must not be accepted. They are Unix timestamps in seconds; this tool converts them to your local date and time.
