Inspect and verify JWT

Inspect complete JWT header and claims, or verify HS256 / RS256 with a separately supplied trusted key.

Browser-local processingInputJWT text or fileOutputInspection JSON or verification reportUp to 1 MiB per file · File limit: 1

1Add input
2Adjust settings
3Get your result

Tool input and files are processed in this browser without being uploaded.

Your input

Inputs are kept temporarily in this tab when switching tools. Refreshing or closing clears them; large results may need to be regenerated.

JWT input source

JWTTrusted secret / RSA public JWK

Options

Complete the required options first. You can keep the defaults for the rest.

Operation

Inspection needs no key and verifies neither identity nor claims. Verification checks the separately supplied key and selected claims.

Expected algorithm

Choose the algorithm from trusted service documentation, not only from the unverified token’s alg field.

Expected issuer (optional)

Enter the exact expected issuer when known. Leaving it blank skips this matching check.

Expected audience (optional)

Enter the audience expected by the receiver. Leaving it blank skips this matching check.

Result

Your result will appear here

Add your input and complete the required options, then run the tool. Your result and available save controls will appear here.

Processed locally

Preparing the tool…

Before you start

Choose inspection or verification. Inspection needs no key and shows unverified previews and offers complete header and claims in downloads without verifying signatures or claims; it establishes no authentication. Verification uses a separately supplied trusted secret or RSA public JWK to check HS256 / RS256 signatures, times, issuer and audience separately.

How to use this tool

Paste a JWT or choose a local JWT text file, then choose inspection or verification.
Inspection needs no key. Read the unverified previews, then copy or download the complete decoded header and claims JSON.
For verification, separately supply a trusted key, choose HS256 / RS256 from trusted configuration and enter expected issuer/audience when needed. Review passed, failed and skipped checks; a signature match alone is not an authorization decision.

Supported inputs and limits

Inspection accepts three Base64URL segments, including an empty signature in an alg=none example; it does not decrypt five-part JWE. Header and claims must be JSON objects; duplicate keys are rejected. Number tokens stay exact, including large integers. Each decoded JSON document is limited to nesting depth 128 and 200,000 value nodes. JSON error positions refer to the decoded document.

Header and claims previews each show the first 4,000 UTF-16 code units. Copy and JSON download retain the complete result; inspection reports are limited to 20 MiB.

RS256 accepts a public RSA JWK; HS256 accepts a shared secret. Only the supplied key is checked. The tool does not fetch JWKS, select keys by kid, or establish key origin; passing checks does not establish authentication or authorization.

Missing exp or nbf claims are not checked. Blank expected issuer or audience skips those checks. Times use this device's clock.

A JWT file or pasted text is limited to 1 MiB; a verification key is limited to 20,000 UTF-16 code units. Files and input stay in the browser, and downloads do not overwrite source files.

Worked example

Example input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwiZXhwIjo0MTAyNDQ0ODAwfQ.Fw5ntfSY0QV9JeGuSmUTyCpK20jYCs7b8i7AeFGAYuQ

Trusted secret / RSA public JWK:
public-example-secret

Example options

{"mode": "verify", "algorithm": "HS256", "issuer": "", "audience": ""}

Example output

{
  "algorithm": "HS256",
  "signatureValid": true,
  "expirationValid": true,
  "notBeforeValid": true,
  "timeValid": true,
  "issuerMatched": true,
  "audienceMatched": true,
  "accepted": true,
  "checksApplied": {
    "expiration": true,
    "notBefore": false,
    "issuer": false,
    "audience": false
  },
  "keyProvenanceChecked": false,
  "claims": {
    "sub": "demo",
    "exp": 4102444800
  }
}

When something does not work

For inspection errors, check three Base64URL segments, UTF-8, JSON objects and duplicate keys; five-part JWE is outside scope. For verification errors, also check the trusted algorithm/key and expected claims. Inspection does not turn a failed verification into a valid token.

Frequently asked questions

How does signature verification differ from decoding?

Inspection only decodes the full header and claims, without signature or claim checks and without a key. Displayed identity, access and time fields are unverified. Verification checks the supplied key and selected claims separately; it does not establish key origin or user access.

What should the example produce?

The public demonstration secret should validate the sample. Change one payload character and verification must fail or the token must be rejected.

Which cases are outside its scope?

You must supply the trusted key. This tool does not fetch JWKS or select a key using kid. It cannot complete Google ID token verification or decide whether a user has access.

Inspect and verify JWT

Result

Your result will appear here

Before you start

How to use this tool

Supported inputs and limits

Worked example

Example input

Example output

When something does not work

Frequently asked questions

Documentation & further reading

Related tools

Base64 encode / decode

URL encode / decode

HTML entities

Unicode escape

Result

Your result will appear here