Tamim Labs

JWT Inspector

Decode a JSON Web Token, read its header, payload and registered time claims, and check its signature — HMAC shared secrets or RS/ES public keys. Everything runs in your browser; your token never leaves your device.

Runs in your browser — nothing is uploaded
Decoding, signing and verification happen entirely on your device.

Token

Waiting for input
Waiting for input

Build & sign

Edit the JSON, choose an algorithm, and sign locally with Web Crypto.

What JWT Inspector does

  • Decode header and payload with a colour-coded, three-segment view
  • Verify HS256/384/512 with a shared secret
  • Verify RS/ES signatures with a public key
  • Build, edit and re-sign tokens (HS/RS/ES and none)
  • Claim validation table with expected issuer/audience
  • Flags unsigned (alg: none) tokens and guessable HMAC secrets

How to use it

  1. 01

    Open the JWT Inspector.

  2. 02

    Paste a token to decode its header and claims.

  3. 03

    Enter a secret or public key to verify the signature.

  4. 04

    Optionally run the weak-secret check.

Common questions

Is my JWT or secret sent anywhere?
No. Tokens are decoded and signatures verified entirely in your browser using your own cryptography. Nothing is transmitted.
Can I verify a token's signature?
Yes. Verify HS256/384/512 with a shared secret, or RS/ES signatures with a public key. You can also edit and re-sign a token, and it flags unsigned (alg: none) tokens and guessable HMAC secrets.
Does it check when a token expires?
Yes. It decodes the claims and shows the expiry in plain terms, alongside a validation table for issuer and audience.

More tools

ReadyJSON Formatter & ValidatorFormat, validate, minify and sort JSON — instantly, in your browser.Runs in your browserOpenReadySQL FormatterPretty-print and tidy SQL across 15+ dialects.Runs in your browserOpenReadyRegEx TesterTest, explain and generate code for regular expressions.Runs in your browserOpen