Skip to content

JWT inspector

Decode and inspect a JSON Web Token (JWT): its header, payload claims and signature segment, with a clear "this is decoding, not verification" framing.

JWTtokeninspectorText

Upload

Files (0–1)
Upload a token file (`.jwt` / `.txt`), or skip this and paste it in the box below. Up to 1 MB. Nothing is sent to an external service and no signature is verified; the report is a decode + describe.

Options

Paste the token instead A JWT is sensitive data: do not paste one you do not intend to share with Tooley. The upload (if any) is deleted on completion; the result stays available for about 10 minutes.
Questions people ask
Does this verify the token?
No. This tool *decodes and describes*: it shows the header (``alg`` / ``typ`` / ``kid``), the payload (every registered claim with its human interpretation, plus your application claims), and the signature segment's presence and length. It never fetches a JWKS, never asks the issuer for metadata, and never has a key to verify with. The report carries a literal ``"verification": "not-performed"`` marker so no downstream consumer can read "decodes cleanly" as "authentic." See the catalogue's signature-verification tools if you need one that takes a key.
Will it warn if the token is expired?
Yes. The ``exp`` / ``nbf`` / ``iat`` claims are shown as human UTC times, and the report's "notes" list a line like "expired 123s before now" when ``exp`` is in the past, or "not yet valid (nbf is in the future)" when ``nbf`` is. This is context, not verification: a token with a future ``exp`` is not, by itself, valid. A verifier also checks the signature and issuer.
What about the 'alg: none' shape?
An ``alg: "none"`` token is the classic "unsigned" credential: any consumer that respects the algorithm claim skips verification entirely. A real verifier must never accept it without a policy that explicitly says "this issuer is trusted to only send signed tokens". When the processor sees it, the report flags it in the signature section ("this is an unsigned JWT and there is no signature segment") and in the top notes, so a human reader sees the warning before they assume the token is normal.
Does it log my token?
No. The token is read in an isolated job, the report is generated, and both the upload and the result follow the 10-minute retention window. The report itself only carries the decoded claims (truncated at 400 chars) plus the header fields and signature-segment length; the raw base64url of the header, payload and signature is not echoed into the report, the result message, or the metadata.
How big a token?
1 MiB total per token. The decoded header and payload each have a 64 KiB cap to keep the JSON walker bounded.