JWT Decoder, Inspector & Expiration Checker
Inspect, debug, and validate JSON Web Tokens locally. Real-time expiration countdown, color-coded structure inspection, and standard claims explanation.
Paste a token or click a sample button to inspect its claims.
{"alg": "none"}{}Standard Claims Breakdown
0 claims| Claim | Name | Decoded Value | RFC 7519 Purpose |
|---|---|---|---|
| No standard claims parsed yet. | |||
Understanding JSON Web Token (RFC 7519) Anatomy
A JSON Web Token consists of three base64url-encoded parts separated by periods (.): Header, Payload, and Signature.
Specifies token metadata, typically the signing algorithm (alg, e.g. HS256, RS256) and type (typ: "JWT").
Contains claims — statements about the entity (such as user ID, email, role, and permissions) and expiration timestamps (exp, iat).
Cryptographic hash calculated from the encoded header, encoded payload, and secret key to verify data integrity.
Frequently Asked Questions about JWT
Is it safe to paste production JWTs into OmniTools?
Yes. OmniTools executes 100% client-side inside your browser sandbox. No token data, secrets, or payloads are ever sent across the network. You can verify this in your browser Developer Network tab.
What does an expired JWT mean?
A JWT with an "exp" (expiration time) claim in the past will be rejected by backend authentication servers with HTTP 401 Unauthorized. Clients must refresh the token via their OAuth/OIDC refresh token flow.
Can this tool verify the cryptographic signature?
The inspector validates the structure and decodes the header and payload. Cryptographic verification of HMAC or RSA/ECDSA signatures requires the server-side secret key or public certificate, which you should never share with any web tool.