What is the Offline JWT Claims Inspector?

This tool decodes a JSON Web Token entirely in your browser, splitting it into its header, payload, and signature so you can read the claims inside without sending the token to any server.

How it works

A JWT is three Base64url-encoded segments joined by dots. The tool splits the string on '.', decodes the header and payload with atob and TextDecoder, and parses the result as JSON. It also reads the exp claim and compares it to the current time to flag expired tokens. It does not verify the signature — that requires the secret or public key the token was originally signed with, which never leaves your own server.

SysAdmin & security use cases

Check why an API is rejecting a token by reading its exp or nbf claims directly.
Confirm which scopes or roles a login flow actually issued before debugging an authorization failure.
Inspect a token copied from browser dev tools without pasting it into a third-party website.
Spot a malformed token — wrong number of segments, broken Base64 padding — before it reaches your backend.