Inspect token claims
Read issuer, subject, audience and time-related claims while debugging authentication flows.
Inspect tool
Decode JWT headers and payloads locally in your browser. No token upload, account or signature-verification claim.
Your input and result are not sent to JSON Hearth or stored on a server.
When to use it
JWT decoding makes the Base64URL-encoded header and payload readable. It does not establish that a token is authentic or safe to trust.
Read issuer, subject, audience and time-related claims while debugging authentication flows.
Check the declared algorithm and payload shape without sending the token to a remote decoder.
Inspect issued-at and expiration values as part of troubleshooting, while still verifying them in trusted code.
How it works
Paste a value, open a local file or begin with the working sample.
The transformation executes in your browser, not on our servers.
Check the output, then copy or download it for your next task.
Important limitations
Decoding does not verify the signature, issuer, audience, expiry or any authorization decision.
Treat bearer tokens as secrets and avoid sharing decoded or raw values unnecessarily.
Common questions
No. Your input is processed by code running in your browser and is not sent to an application server.
Yes. The tool is free, requires no account and can be used directly in the browser.
No. Anyone can decode the header and payload. Verification requires the correct key and trusted validation logic.
Only after a trusted system has verified the signature and enforced issuer, audience, expiry and application rules.