JWT Inspector and Generator
Inspect JWT headers, payloads, claims, and expiration times, or generate test tokens with an HMAC secret. Token data and secrets stay in your browser.
This tool runs entirely in your browser. Your input is never uploaded.
What is a JWT?
A JSON Web Token usually contains three dot-separated Base64URL segments: a header, a payload, and a signature. The header describes the token type and signing algorithm. The payload contains claims such as the subject, issuer, audience, and time limits.
How to inspect a token
- Paste the complete token into the input field.
- Select Decode JWT.
- Review the formatted header and payload.
- Check
iat,nbf, andexpvalues in local and UTC time.
Decoded headers and payloads open in syntax-highlighted trees. Expand or collapse nested objects and arrays, or switch either panel to Text view to inspect the complete JSON.
The signature is displayed in its encoded form so it can be copied, but it is not validated.
How to generate a JWT
- Switch to Generate JWT.
- Select HS256, HS384, or HS512.
- Enter a JSON header and payload.
- Enter an HMAC secret and generate the token.
- Copy the result or open it in the inspector.
The generator sets the header's alg value to the selected algorithm. The secret is used only for signing in the current browser and is not stored or uploaded.
When to use the generator
Generation is intended for API development, test fixtures, and learning JWT structure. Production applications must not embed real signing secrets in frontend code or rely on a browser to issue trusted identity tokens. Issue production tokens on a trusted server and strictly validate their algorithms, signatures, and claims.
Decoding is not verification
Anyone can create or modify a JWT payload. Successfully decoding a token proves only that its segments contain readable data. It does not prove who issued the token or whether its contents are trustworthy.
Applications must verify the signature with the expected algorithm and trusted key before accepting a JWT. They should also validate issuer, audience, expiration, not-before time, and other application-specific claims.
JWT time claims
JWT iat, nbf, and exp claims use NumericDate values: the number of seconds since 1970-01-01 00:00:00 UTC. This tool converts those values to browser-local time and ISO 8601 UTC.
Privacy
Tokens are inspected and generated entirely in your current browser. They are not sent to this site's server. Tokens and secrets can contain credentials or personal data, so avoid sharing them in messages, screenshots, logs, and support tickets.
Frequently asked questions
Can this tool tell me whether a JWT is authentic?
No. Authenticity requires cryptographic signature verification using a trusted key and an explicitly allowed algorithm.
Why can an expired token still be decoded?
Expiration controls whether an application should accept a token. It does not encrypt or erase the token's contents.