JWT Inspector
Decode and inspect JWT payloads and headers safely in the browser.
JWT Inspector
Runs entirely in your browser
This tool executes locally using standard browser APIs (for example window.crypto.getRandomValues or crypto.subtle where applicable). Your input is not transmitted to or stored on a ScriptPulse server. See How Calculations Work.
What This Tool Does
- The JWT Inspector is an interactive, browser-native utility designed to inspect, decode, and troubleshoot JSON Web Tokens (JWT) safely. JWT is an open standard (RFC 7519) defining a compact, self-contained method for securely transmitting information as a JSON object. Signed using secret keys (HMAC) or public/private key pairs (RSA/ECDSA), JWTs are widely used in stateless API authentication. Once a client logs in, the authentication server issues a token containing claims that the API gateway can validate. This stateless model reduces database queries but requires developers to inspect token claims during integration tests.
- A common security mistake is pasting active production tokens into online tools that transmit payloads to backend servers, exposing session credentials to log storage. The ScriptPulse JWT Inspector resolves this by decoding tokens entirely client-side. The Base64URL payload decoding and signature format checking are executed in local memory. This ensures that session details, roles, user scopes, and API identifiers remain secure on your device.
How It Works
- The inspector splits the JWT string at the period markers into three segments: Header, Payload, and Signature.
- The Base64URL-encoded strings of the Header and Payload are normalized to standard Base64 by mapping URL-safe characters (- and _ back to + and /) and adding padding.
- The base64 values are decoded into JSON strings and parsed into structured JavaScript objects.
- The validation parser extracts standard claims like exp (Expiration), iat (Issued At), and nbf (Not Before) to calculate the remaining lifespan.
- The formatted results are rendered in syntax-highlighted editor panels.
Usage
- Paste your raw JSON Web Token string into the input editor.
- Review the decoded Header and Payload outputs in the panels.
- Examine the validation summary to check if the token is active or expired.
- Verify that custom claims and security groups are structured correctly.
- Copy decoded values or load sample data to see a demonstration.
Examples
- Decoding a standard access token: Verifying that `sub` matches the user profile and `exp` points to a future timestamp.
- Debugging OIDC ID tokens: Checking user details (email, permissions) in the payload segment.
- Verifying algorithm headers: Confirming that the `alg` header parameter is configured correctly.
- Auditing scope fields: Reviewing the access scope list inside client tokens.
Real-World Use Cases
- Inspecting user claims and scopes in tokens issued by OAuth2 providers (like Auth0 or Okta) during API setup.
- Troubleshooting token expiration bugs on frontend clients by verifying the exp timestamp value.
- Auditing token headers to verify that the signing algorithm matches security policies (e.g. RS255 vs HS256).
- Checking audience and issuer claims during multi-tenant integrations.
- Reviewing payload size to prevent tokens from exceeding HTTP header size limits.
Best Practices
- Keep access token lifetimes short (e.g. 15 minutes) and use refresh tokens for session extensions.
- Validate the aud (Audience) claim on the server to prevent token confusion attacks.
- Never store sensitive passwords or private keys inside unencrypted JWT claims.
- Verify the alg parameter on the backend to enforce secure cryptographic standards.
Common Mistakes
- Assuming JWT payloads are encrypted: standard tokens are only Base64 encoded and can be read by anyone who intercepts them.
- Pasting active production tokens into online tools, risking credential exposure in server logs.
- Treating JWT timestamp fields (like exp or iat) as milliseconds instead of Unix epoch seconds.
- Ignoring signature checks on the backend, allowing clients to modify permissions.
Limitations
- This tool decodes token segments but does not verify signatures against cryptographic keys.
- Malformed tokens missing standard segment separators will trigger syntax warnings.
- Data is processed in transient state; reloading the tab clears the workspace.
Technical Reference Guide
- sub (Subject): Identifies the user or principal the token represents.
- iss (Issuer): Identifies the security authority that signed the token.
- aud (Audience): Identifies the target API client for which the token is intended.
- exp (Expiration): Unix timestamp marking when the token becomes invalid.
FAQ
Is my token secure when using this tool?
Yes. The JWT Inspector decodes the Base64 URL segments locally in your browser. No data is sent to external servers.
Can this tool verify the signature of my token?
No. Signature verification requires importing the cryptographic key or secret. For security, verification should only be run on secure backend servers.
Why does my token only have two parts?
A standard signed JWT has three parts separated by dots. If it only has two, it is likely an unsigned token, which is insecure and not recommended for production.
What does 'Invalid Token Structure' mean?
This error indicates that the pasted string does not contain exactly three dot-separated segments or contains invalid characters.
What is the difference between a JWT and a cookie?
A cookie is a browser storage and transport mechanism. A JWT is a token formatting standard. JWTs can be stored in cookies or passed in Authorization headers.
Why do JWTs use Base64URL encoding?
Base64URL replaces characters like '+' and '/' with '-' and '_', and removes '=' padding, ensuring the token is safe to use in URLs and headers.
What is the kid header parameter?
The Key ID ('kid') header parameter indicates which public key was used to sign the token, helping backend systems manage key rotation.
How do I handle token revocation?
JWTs are stateless and cannot be easily revoked. Keep access token lifetimes short and manage active sessions via refresh tokens in a database.
What is the alg parameter in the header?
The 'alg' parameter specifies the cryptographic algorithm used to sign the token (e.g. HS256, RS256).
Can standard JWT payloads be encrypted?
Yes. Encrypted tokens are called JWE (JSON Web Encryption). The JWT Inspector decodes standard signed tokens (JWS); it cannot decode encrypted JWE payloads.
Is exp represented in seconds or milliseconds?
Standard JWT claims represent timestamps as Unix epoch seconds, not milliseconds.
Does the tool support OIDC ID tokens?
Yes. ID tokens conform to the JWT standard and can be decoded and inspected in the same way.
Part of this Developer Hub
This utility is part of our comprehensive Authentication & Tokens Lab topic workspace.
Explore foundational guidelines, technical specifications, and other interactive utilities related to this workflow.
Related Tools
Explore related utilities inside the Security Lab workshop for complementary engineering workflows.
View all Security Lab tools