JWT Decoder & Inspector

The JWT Inspector provides: expiry countdown (not just timestamp), algorithm security warnings (HS256 vs RS256), claim-by-claim explanations (what iat, exp, sub, iss, aud mean), structure validation, and color-coded severity for potential issues like missing expiry or insecure algorithms.

Yes — all decoding happens 100% in your browser using JavaScript. Your JWT is never sent to any server. The tool reads the Base64-encoded header and payload, which are not encrypted — only the signature requires the secret to verify. Avoid pasting tokens with highly sensitive PII into any third-party tool; use this for development and debugging.

HS256 (HMAC-SHA256) uses a shared secret — both the issuer and verifier use the same key. Anyone with the key can issue tokens. RS256 (RSA-SHA256) uses a private/public key pair — only the issuer has the private key, verifiers use the public key. RS256 is preferred for public APIs and multi-service architectures.

The 'exp' (expiration) claim is a Unix timestamp. If exp is in the past relative to your current time, the token is expired and should be rejected by any compliant verifier. JWTs don't auto-refresh — your application must obtain a new token (via refresh token or re-authentication) when the current one expires.

'nbf' (Not Before) is a Unix timestamp indicating the earliest time the token is valid. If nbf is in the future, the token should be rejected — it hasn't become valid yet. This is used for tokens issued in advance, like a scheduled access grant.