Toolkit Shelf
Find

JWT Decoder and Claims Inspector

Use this JWT decoder and claims inspector to review token header fields, payload claims, timestamps, scopes, audience, issuer, and signature boundaries before debugging an auth flow.

Live developer utility

JWT decoder and claims inspector

Decoded payload
{
  "sub": "user_123",
  "name": "Toolkit Shelf",
  "iss": "https://toolkitshelf.com",
  "aud": [
    "toolkitshelf",
    "mcp"
  ],
  "iat": 1717200000,
  "nbf": 1717200000,
  "exp": 4102444800,
  "scope": "read:tools write:drafts"
}
Token statusDecoded

Header and payload decoded as JSON.

AlgorithmHS256

JWT type, 16 signature characters.

Header fields

Header fields describe token type, algorithm, and key hints. They are not proof of authenticity without verification.

ClaimValueNote
algHS256Algorithm named by the token header. This decoder does not verify it.
typJWTType hint for the token, commonly JWT.
Payload claims

Payload claims are decoded from the token body. Check issuer, audience, subject, and time claims before trusting a flow.

ClaimValueNote
subuser_123Subject: who or what the token represents.
nameToolkit ShelfCustom claim or provider-specific field.
isshttps://toolkitshelf.comIssuer: who issued the token.
aud["toolkitshelf","mcp"]Audience: intended API, app, or service that should accept the token.
iat1717200000Issued-at time as a Unix timestamp in seconds.
nbf1717200000Not before time as a Unix timestamp in seconds.
exp4102444800Expiration time as a Unix timestamp in seconds.
scoperead:tools write:draftsSpace-delimited permissions or access scopes in many OAuth-style tokens.
Time claim check
Time claimUTC timeStatus
exp2100-01-01T00:00:00.000Z (4,102,444,800)Valid
nbf2024-06-01T00:00:00.000Z (1,717,200,000)Active
iat2024-06-01T00:00:00.000Z (1,717,200,000)Issued
Warnings
Review note
This decoder does not verify the signature. Treat the output as decoded text, not proof that the token is trusted.
Decoded header

{ "alg": "HS256", "typ": "JWT" }

Signature boundary

The signature preview is sample-signature. This tool does not verify the signature or fetch signing keys.

Privacy note

JWTs can contain user IDs, emails, scopes, tenant IDs, session hints, or other private data. Decode only tokens you are allowed to inspect and avoid pasting production credentials into shared sessions.

Generation method

Compact token decoding method

Decoded JWT = split compact token into header.payload.signature + Base64URL-decode header and payload + JSON.parse claims + compare NumericDate claims with current time

This decoder does not verify signatures or fetch signing keys. Use it to inspect token contents, not to prove a token is trusted.

How to use

Steps

  1. Paste a compact JWT in header.payload.signature format.
  2. Review the decoded header for alg, typ, kid, or other key hints.
  3. Check payload claims such as iss, sub, aud, scope, exp, nbf, and iat.
  4. Use the warnings to identify expired tokens, missing exp claims, alg=none, empty signatures, and verification boundaries.

Example

Sample output

Header{"alg":"HS256","typ":"JWT"}
Payload claimsub=user_123, aud=toolkitshelf, exp=4102444800
OutputDecoded JSON, claim table, UTC time checks, and verification warning

Generator use

Best for

  • Browser-side link, file, format, and web utility tasks that need an output now.
  • Generating reusable artifacts such as QR codes, snippets, exports, or cleaned payloads.

Before relying on it

Check first

  • This decoder does not verify signatures or fetch signing keys. Use it to inspect token contents, not to prove a token is trusted.
  • Publishing a generated file or code without testing it in the real destination.
  • Encoding private or sensitive data into an output that other people can scan, copy, or inspect.

Details

What to know before using the output

Decode scopeHeader and payload

The tool decodes the first two JWT segments as Base64URL JSON and reports signature segment length separately.

VerificationNot performed

A decoded token can still be forged, expired, signed with the wrong key, or intended for another audience.

Time claimsexp, nbf, iat

NumericDate claims are converted to UTC and compared with the current browser time for quick debugging.

Source notes

References used for this generator

RFC 7519Defines JSON Web Token structure, registered claims, NumericDate values, and compact serialization.RFC 7515Defines JSON Web Signature compact serialization and JOSE header behavior used by signed JWTs.

Benchmarks

How to read the output

exp: Expiration.

Expired tokens should normally be rejected by the receiving application or API.

aud: Audience.

A token can be validly signed but still wrong for the API or app receiving it.

alg: Algorithm hint.

The header names an algorithm, but only real signature verification proves trust.

Method and limitations

Methodology and assumptions

Formula, inputs, limitations and review record
Generation method

Decoded JWT = split compact token into header.payload.signature + Base64URL-decode header and payload + JSON.parse claims + compare NumericDate claims with current time

Inputs used

Compact token, Header, Payload, Signature segment, Claims, Time claims

Limitations

Utility outputs depend on the encoded payload, file format, target app, scanner, printer, browser, and real-world testing before sharing.

Review record

Catalog QA baseline on June 6, 2026. This date marks the catalog-wide automated and editorial QA baseline, not a tool-specific expert review.

Cite this page

Toolkit Shelf. JWT Decoder and Claims Inspector. https://toolkitshelf.com/tools/jwt-decoder-claims-inspector

FAQ

Common questions

Does this JWT decoder verify the signature?

No. It decodes the header and payload so you can inspect claims. It does not verify signatures, secrets, public keys, issuer trust, or audience enforcement.

Is it safe to paste a JWT?

JWTs can contain user IDs, emails, scopes, tenant IDs, or session hints. Decode only tokens you are allowed to inspect, and avoid pasting production credentials into shared sessions.

What JWT claims should I check first?

Start with iss, sub, aud, exp, nbf, iat, scope or scp, alg, and kid. Those usually explain issuer, subject, audience, time validity, permissions, and signing-key hints.