Gray-wolf Tools Logo Gray-wolf Tools
Decorative header image for JWT Inspector: Secure Decoder & Verifier - Complete Guide

JWT Inspector: Secure Decoder & Verifier - Complete Guide

Decode, inspect, and verify JSON Web Tokens securely in your browser with real-time validation, timestamp conversion, and signature verification for authentication debugging.

By Gray-wolf Tools Team • Security Tools Specialist
Updated 11/3/2025 • ~800 words
jwt json-web-token decoder verifier security authentication signature timestamp debugging

Executive Summary

JSON Web Tokens (JWTs) have become the de facto standard for modern web authentication and authorization, but debugging and verifying these encoded tokens can be challenging. The JWT Inspector tool solves this problem by providing a secure, browser-based environment for decoding, inspecting, and verifying JWT tokens without ever sending your sensitive authentication data to external servers.

Whether you’re a backend developer troubleshooting authentication issues, a security engineer auditing token implementations, or a frontend developer integrating OAuth flows, this tool provides instant visibility into JWT structure, claims, and signature validity. All processing happens entirely client-side using Web Crypto API, ensuring your tokens remain private and secure.

Feature Tour & UI Walkthrough

Token Input Area

The tool features a prominent text area where you can paste your JWT token. The interface automatically detects valid JWT format (three base64url-encoded segments separated by periods) and provides immediate feedback. As you paste a token, the tool instantly begins parsing and displaying its components.

Header & Payload Display

Once decoded, the JWT’s header and payload are displayed in beautifully formatted, syntax-highlighted JSON. The header typically reveals the signing algorithm (HS256, RS256, etc.) and token type, while the payload contains your claims such as sub (subject), iss (issuer), exp (expiration), and custom application-specific data.

Timestamp Conversion

JWT timestamps are stored as Unix epoch seconds, which are difficult to read. The tool automatically detects standard JWT time claims (iat, exp, nbf) and displays them in human-readable format alongside the raw values, making it easy to verify token validity periods.

Signature Verification Panel

The signature verification feature allows you to paste the secret key (for HMAC algorithms) or public key (for RSA/ECDSA algorithms) to cryptographically verify the token’s authenticity. A clear visual indicator shows whether the signature is valid, helping you quickly identify tampered or malformed tokens.

Security Indicators

Color-coded badges and alerts highlight important security information, such as expired tokens, weak algorithms (like HS256 with short secrets), or missing critical claims. These visual cues help you spot potential security issues at a glance.

Step-by-Step Usage Scenarios

Scenario 1: Debugging Authentication Failures

Problem: Your application is rejecting JWT tokens from a third-party OAuth provider.

Solution Steps:

  1. Copy the failing JWT token from your browser’s DevTools network tab or authentication header
  2. Paste the token into the JWT Inspector
  3. Check the exp (expiration) claim to ensure the token hasn’t expired
  4. Verify the aud (audience) claim matches your application identifier
  5. Compare the iss (issuer) claim against expected values
  6. If signature verification fails, confirm you’re using the correct public key from the provider’s JWKS endpoint

Scenario 2: Understanding Third-Party API Tokens

Problem: You need to integrate with an API that returns JWTs but the documentation is unclear about what claims are included.

Solution Steps:

  1. Make a test API request and capture the JWT response
  2. Decode the token using JWT Inspector to view all available claims
  3. Document the claim structure for your integration
  4. Identify which claims contain user information, permissions, or session data
  5. Check expiration times to plan your token refresh strategy

Scenario 3: Validating Custom JWT Implementation

Problem: You’ve implemented JWT generation in your backend and need to verify the tokens are correctly formatted.

Solution Steps:

  1. Generate a test token from your backend endpoint
  2. Paste it into JWT Inspector
  3. Verify the header contains the correct algorithm (e.g., RS256)
  4. Confirm all required claims are present in the payload
  5. Use your secret key to verify the signature matches
  6. Test with tokens at different expiration states to ensure proper validation

Scenario 4: Security Audit of Legacy Tokens

Problem: You’re auditing an older application and need to assess JWT security practices.

Solution Steps:

  1. Collect sample JWT tokens from various parts of the application
  2. Decode each token to check for sensitive data exposure in claims
  3. Verify appropriate expiration times are set (exp claim)
  4. Check if refresh token rotation is implemented (using JWT Generator for comparison)
  5. Ensure tokens use strong algorithms (RS256 or stronger, not HS256 in production)
  6. Look for potential information leakage in custom claims

Code or Data Examples

Example JWT Token Structure

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decoded Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Decoded Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1516242622
}

Common JWT Claims Explained

  • iss (Issuer): Identifies who created and signed the token
  • sub (Subject): Unique identifier for the user or entity
  • aud (Audience): Intended recipient(s) of the token
  • exp (Expiration): Unix timestamp when token expires
  • iat (Issued At): Unix timestamp when token was created
  • nbf (Not Before): Token should not be accepted before this time
  • jti (JWT ID): Unique identifier for this specific token

Troubleshooting & Limitations

Common Issues

“Invalid JWT format” Error

  • Ensure the token has exactly three parts separated by periods (.)
  • Check that no whitespace or line breaks were accidentally copied
  • Verify the token wasn’t truncated during copy/paste

Signature Verification Fails

  • Confirm you’re using the correct secret/public key
  • For public key verification, ensure the key is in PEM format
  • Check that the algorithm in the header matches your verification method
  • Remember that HS256 uses symmetric keys while RS256 uses asymmetric pairs

Timestamps Appear Incorrect

  • JWT timestamps are in UTC; adjust for your local timezone
  • Verify the token generator is using correct epoch time (seconds, not milliseconds)
  • Check if the exp claim was set too far in the future or past

Cannot Verify Signature for RSA Tokens

  • Ensure you’re pasting the public key, not the private key
  • Public keys should start with -----BEGIN PUBLIC KEY-----
  • Some providers distribute keys via JWKS endpoints in JSON format that need conversion

Tool Limitations

  • The tool cannot verify tokens requiring external API calls for validation
  • Encrypted JWTs (JWE) are not currently supported, only signed JWTs (JWS)
  • Custom claim validation rules must be checked manually
  • The tool doesn’t store tokens or maintain a history for security reasons

Frequently Asked Questions

Q1: Is it safe to paste my JWT tokens into this tool?

A: Yes, it’s completely safe. All token processing happens entirely in your browser using JavaScript. No tokens are sent to any server, logged, or stored. You can verify this by opening your browser’s network DevTools while using the tool—you’ll see no outgoing requests containing token data. For maximum security, you can even use the tool offline.

Q2: Can I use this tool to generate JWT tokens?

A: No, the JWT Inspector is designed only for decoding and verifying existing tokens. For token generation, use our companion JWT Generator Tool, which supports multiple algorithms and custom claims configuration.

Q3: What’s the difference between HS256 and RS256 algorithms?

A: HS256 (HMAC with SHA-256) uses a symmetric secret key—the same key signs and verifies the token. This is simpler but requires sharing the secret between services. RS256 (RSA with SHA-256) uses asymmetric cryptography—a private key signs the token, and a public key verifies it. RS256 is preferred for distributed systems where you can’t safely share a secret key with all parties.

Q4: Why does the tool show my token is expired when it should still be valid?

A: Check these common causes: (1) Your system clock may be incorrect or out of sync, (2) The token generator might be using milliseconds instead of seconds for timestamps, (3) You may be in a different timezone than the token issuer—JWT timestamps are always in UTC, (4) The token’s exp claim might have been set incorrectly during generation.

A: Yes! Most OAuth providers use standard JWT formats. For signature verification, you’ll need their public key, typically available from their JWKS (JSON Web Key Set) endpoint. The JWT header often contains a kid (Key ID) that tells you which key from the JWKS to use. You can convert JWKS entries to PEM format for use in this tool.

Q6: What should I do if I discover sensitive data in a JWT payload?

A: This is a serious security concern. JWT payloads are base64-encoded, not encrypted—anyone with the token can decode and read the claims. If you find passwords, API keys, credit card numbers, or other sensitive data: (1) Immediately rotate the exposed credentials, (2) Modify your token generation to exclude sensitive fields, (3) Consider implementing encrypted JWTs (JWE) if you must include sensitive data, (4) Use secure claim values like user IDs instead of full user records.

Q7: How can I validate custom claims beyond standard ones?

A: The tool displays all claims in the payload, but you’ll need to manually verify custom claims against your application’s requirements. Check that required custom claims exist, contain expected data types, and have valid values. For complex validation rules, you might need to implement additional checks in your application code rather than relying solely on this inspection tool.

References & Internal Links

External Resources & Standards

Accessibility Features

This tool supports keyboard navigation for all input fields and buttons. Token displays use semantic HTML with proper ARIA labels for screen readers. The color-coded status indicators include text descriptions to ensure information isn’t conveyed by color alone, making the tool accessible to users with color vision deficiencies.