JWT Inspector
Decode, inspect, and verify JSON Web Tokens with claim analysis and signature validation.
Supports HS256, RS256, and ES256 with a shared secret, PEM public key, or JWK.
What is JWT Inspector?
A JWT decoder inspects JSON Web Tokens used by OAuth/OIDC and APIs — header algorithm, claims, expiry, and optional signature verification.
How it works
Paste a compact JWT. PacketWizard Base64URL-decodes header and payload, highlights standard claims, and can verify signatures when you provide a key.
Common issues
alg=none or unexpected algorithm
Reject tokens that advertise none or algorithms your API does not allow. Always validate alg against an allowlist server-side.
Clock skew on exp/nbf
Small allowed skew is common, but large failures usually mean wrong token, wrong environment, or device clock issues.
Frequently asked questions
Is decoding a JWT the same as verifying it?
No. Anyone can decode a JWT. Verification checks the signature with the issuer’s key so claims can be trusted.
Related tools
Continue with these related PacketWizard tools for adjacent diagnostics.