Safely decode and inspect JSON Web Token headers, payload claims, signature structures, and expiration dates. Features automatic `exp` timestamp validation, human-readable date formatting, and 100% private browser processing.
Paste your three-part dot-separated JWT token string (`header.payload.signature`) into the input area.
The tool instantly parses Base64URL-encoded strings into readable JSON structures.
View live token validity status with human-readable expiration (`exp`), issued-at (`iat`), and not-before (`nbf`) dates.
Inspect signing algorithm (`alg`: HS256, RS256) and token type (`typ`: JWT).
Review user IDs (`sub`), roles, permissions, scopes, and issuer (`iss`) claim data.
Click section copy icons to copy formatted Header or Payload JSON objects independently.
Debug ID tokens and access tokens generated by Auth0, Keycloak, Firebase, or Supabase.
Verify whether user access tokens have expired or contain required authorization roles.
Check tenant IDs, user permissions, and custom claim attributes passed across backend APIs.
Inspect Bearer tokens passed inside HTTP `Authorization` headers.
A JSON Web Token (JWT) is an open standard (RFC 7519) for transmitting authentication claims securely between systems. A valid JWT consists of three Base64URL-encoded strings separated by dots:
HEADER.PAYLOAD.SIGNATURE
Contains JSON metadata specifying the signing algorithm (alg: HS256, RS256) and token type (typ: JWT).
Contains claims (statements) about an entity. Standard registered claims include:
sub (Subject / User ID)iss (Issuer Domain)exp (Expiration Unix Timestamp)iat (Issued At Unix Timestamp)Cryptographic HMAC hash or digital signature used to verify token integrity.
Inspect SSL/TLS certificates, domain expiration dates, chain of trust, and cipher suites.
Generate cryptographically secure passwords and memorable multi-word passphrases.
Generate RSA/ECDSA private keys, Certificate Signing Requests (CSR), and OpenSSL req.conf configuration files for direct URLs and wildcard domains (*.domain.com).