DEVAREA TOOLSINDEPENDENT DEVELOPER UTILITIES
Open a tool
Tool 001 / Token inspection

See what the token says.
Not what it proves.

A practical JWT formatter and decoder for reading a compact token’s header, payload, signature segment and common time claims—without confusing decoding with validation.

Runs in your browserNo accountDecode ≠ verify
Anatomy / 3 segments
header.payload.signature

A signed compact JWT is a series of encoded segments separated by periods. The first two are readable after Base64url decoding; the final segment is a cryptographic signature or MAC.

01 / HEADER02 / PAYLOAD03 / SIGNATURE

JWT inspection workbench

LOCAL PARSING / NO API
Processed in this browser. The decoder script makes no request to a JWT service. Do not use a shared or compromised device for sensitive tokens.

Ready. Paste a token or load the example to inspect its structure.

In one sentenceA JWT formatter decodes the first two Base64url segments into JSON so you can inspect the header and claims; it does not establish that the token is authentic.

What are the three parts of a JWT?

A typical signed compact JWT looks like xxxxx.yyyyy.zzzzz. Periods separate a protected header, a claims payload and a signature. The first two segments are Base64url-encoded JSON. The final segment carries a cryptographic value computed over the protected header and payload for the relevant signing algorithm.

PartUsually containsWhat the inspector can tell you
HeaderAlgorithm identifier and token type; sometimes key ID.Which header values are present, not whether they should be trusted.
PayloadClaims about a subject, issuer, audience or application-specific data.Readable JSON and common timestamp interpretations.
SignatureMAC or digital signature bytes encoded for compact transport.The existence and length of the encoded segment—not its validity.

Decode vs. verify: why the difference matters

Base64url encoding is not encryption. Anyone who obtains an ordinary signed JWS token can usually decode its header and payload. A signature is intended to let a verifier check integrity and authenticity, but a formatter that does not have the correct verification key and policy cannot do that check.

For production validation, use a maintained JWT library. Configure accepted algorithms in your application, verify the signature using a trusted key, and validate the expected issuer, audience, time claims and authorization rules. Never let the token's untrusted alg header decide the application's allowed verification algorithms.

What the time claims mean

exp is the expiry time, nbf is the not-before time, and iat is the issued-at time. These common JWT time values use NumericDate, typically seconds from 1 January 1970 UTC. Applications may apply a small clock-skew allowance, and the exact validation policy is application-specific.

Common decode errors

  • Wrong number of segments: a standard compact JWS JWT has three parts. An encrypted compact JWE often has five.
  • Invalid Base64url: check for missing characters, pasted quote marks inside the token, or characters altered during copying.
  • Invalid JSON: a segment may decode to bytes but not to a JSON object. The token may be truncated, malformed or a different format.
  • Expired timestamp: the local clock comparison is a clue, not proof of the application's full validation result.

For field-by-field meanings, continue to the JWT claims reference. If you want the anatomy and encoding explained first, read JWT token parts.

FAQ / JWT

Questions people ask about JWT formatters.

Clear answers for decoding, formatting and safe validation.

What does a JWT formatter do?

A JWT formatter splits a compact token into its segments, decodes the Base64url-encoded header and payload as JSON, and makes claims easier to inspect. Formatting alone does not verify a signature.

Does this JWT inspector validate the signature?

No. It does not check a signing key, cryptographic signature, issuer, audience, or your application’s authorization rules. A decoded token must not be treated as trusted.

What are the three parts of a JWT?

A typical signed compact JWT has a protected header, a payload containing claims, and a signature segment, separated by periods.

What do exp, iat and nbf mean?

exp is the expiration time, iat is the issued-at time, and nbf is the earliest time the token should be accepted. These NumericDate claims are commonly represented as seconds since the Unix epoch.

Is my JWT uploaded?

The tool uses client-side JavaScript to parse the token and does not send it to a decoding API. Use only devices and pages you trust, and never expose production credentials in public logs or screenshots.

Can it decode an encrypted JWE token?

No. This page handles three-part compact JWS-style tokens. Compact encrypted JWE commonly has five segments and requires a different decryption workflow and keys.

Next / Learn the fields

Every claim has a job.

Read what each registered claim means, which values are optional, and what a receiving service must decide for itself.

Open the claims guide ↗