JWT (JSON Web Token) Inspector & Decoder

Inspect JWT headers, decode payload claims, verify expiration with live countdown, and validate HMAC signatures.

🔒 100% Client-Side Decoded — Zero Server Data Transmission

Your data is computed entirely inside your browser's JavaScript engine and is never sent to our servers.

Sample Tokens:

Encoded JWT String

Header Payload Signature

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguYXBleHRvb2xzLmRldi8iLCJzdWIiOiJ1c3JfOThhNzZiYzMyZCIsImF1ZCI6ImFwZXh0b29scy1hcGktdjIiLCJuYW1lIjoiQWxleCBNZXJjZXIiLCJlbWFpbCI6ImFsZXgubWVyY2VyQGVudGVycHJpc2UuaW8iLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwicm9sZSI6ImFkbWluaXN0cmF0b3IiLCJwZXJtaXNzaW9ucyI6WyJhbmFseXRpY3M6cmVhZCIsImNvbnZlcnRlcnM6dW5saW1pdGVkIiwiYmlsbGluZzphZG1pbiJdLCJpYXQiOjE3OTI2MjkwMDEsImV4cCI6MTc5MjYzMjYwMX0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Token Lifespan Status

Active — Expires in 01h : 00m : 00s

Expires: 1:30:01 AM (10/22/2026)

Cryptographic Algorithm

HS256

Token Type: JWT

Issued At (iat)

12:30:01 AM

Thu, 22 Oct 2026 00:30:01 GMT

Decoded Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Decoded Payload Claims

iss(Issuer)RFC 7519

Identifies principal that issued the JWT

https://auth.apextools.dev/

sub(Subject)RFC 7519

Identifies the principal subject of the JWT (user ID / entity)

usr_98a76bc32d

aud(Audience)RFC 7519

Identifies the recipients that the JWT is intended for

apextools-api-v2

name(Full Name)RFC 7519

Subject end-user full name

Alex Mercer

email(Email Address)RFC 7519

Subject email identifier

alex.mercer@enterprise.io

email_verified(Email Verified)RFC 7519

Whether the subject email has been verified

true

role(User Role)RFC 7519

Security authorization role

administrator

permissions(permissions)

Custom application claim

["analytics:read","converters:unlimited","billing:admin"]

iat(Issued At)RFC 7519

Identifies the time at which the JWT was issued

10/22/2026, 12:30:01 AM (Thu, 22 Oct 2026 00:30:01 GMT)

exp(Expiration Time)RFC 7519

Identifies the expiration time on or after which the token must not be accepted

10/22/2026, 1:30:01 AM (Thu, 22 Oct 2026 01:30:01 GMT)

HMAC-SHA256 Signature Verifier

Verify whether the cryptographic signature matches your secret key

Enter Secret Key Below

HMAC Secret Key (Base64 / UTF-8)

💡 Secret is tested in-memory with Web Crypto / CryptoJS and never sent to any server.

100% Private• Instant