~/tools $ ./jwt --inspect

JWT Decoder

Decode a JSON Web Token's header and claims, see expiry in plain English, and flag risky settings.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Header
Payload
Timestamps
Findings
What this does and does not do
This tool decodes and reviews a token. It does not verify the signature, because that needs the server's secret or public key. A token that decodes cleanly here is not proof that it is valid.
What to test in an authorized assessment
  • Does the server reject a token whose signature has been changed? It should, every time.
  • Does it reject expired tokens, or tokens used before nbf?
  • Does it pin the expected algorithm, rather than trusting the alg header?
  • Is the token revoked on logout and password change, or does it live until exp?
PortSwigger's free JWT attacks labs let you practice each of these against targets built for it.