JWT Inspector
The JWT Inspector produces a structured audit report for any JSON Web Token: the declared algorithm and type, every standard claim it carries, and automatic conversion of Unix timestamps into readable local dates.
What This Tool Does
Where the decoder shows raw JSON, the inspector interprets it. It reads the header to identify the signing algorithm and token type, walks the payload claim by claim, labels registered claims such as iss, sub, aud, exp, nbf and iat, and renders numeric dates as human-readable timestamps so you can audit a token at a glance.
How to Use
- Paste a JWT into the input field — the inspection report is generated automatically.
- Check the algorithm and token type reported from the header.
- Review each claim, with iat, exp and nbf shown as readable dates.
- Copy or download the report for documentation or debugging notes.
Key Features
- Structured breakdown of header, payload and signature
- Automatic labeling of registered JWT claims
- Unix timestamps converted to readable local dates
- Highlights missing or unusual structural elements
- Copy and download the full inspection report
- Runs entirely in your browser — nothing is uploaded
Common Use Cases
- Auditing tokens issued by your authorization server
- Comparing tokens across environments during debugging
- Documenting the claim structure of a third-party API
- Teaching or learning JWT anatomy with real examples
- Spot-checking that issued tokens contain the expected claims
Understanding Registered Claims
RFC 7519 defines a set of registered claims with agreed meanings: iss identifies the issuer, sub the subject, aud the intended audience, exp the expiration time, nbf the earliest valid time, iat the issuance time and jti a unique token identifier. None of them are mandatory, but validators rely on them to decide whether a token should be accepted.
Custom claims are application-defined and share the namespace with registered ones, so name them carefully to avoid collisions.
Frequently Asked Questions
What does the JWT Inspector show that the decoder does not?
The inspector interprets the token: it labels registered claims, converts timestamps to readable dates and summarizes the structure, instead of only printing raw JSON.
Does the inspector verify the signature?
No. Inspection reads and interprets the token content. Use the JWT Signature Verifier to confirm authenticity.
Which claims does it recognize?
All registered claims — iss, sub, aud, exp, nbf, iat and jti — plus any custom claims present in the payload.
Why are some timestamps shown as dates?
NumericDate claims such as iat, exp and nbf are seconds since the Unix epoch. The inspector converts them to your local time so they are easier to read.
Is my token uploaded for analysis?
No. The entire inspection runs in your browser; the token never leaves your device.
What does a missing exp claim mean?
The token has no built-in expiration. Many systems consider that risky — check whether the issuer intends tokens to be long-lived before accepting them.
Related JWT Tools
- JWT Decoder — Decode JWT tokens to view header and payload
- JWT Claims Viewer — View all JWT claims in a tree-style format
- JWT Expiry Checker — Check if JWT token is expired and view time remaining
- JWT Timestamp Converter — Convert JWT timestamps to readable dates