The JWT Inspector decodes a JSON Web Token and explains every part of it: the header, the payload with named and interpreted claims, the signature, the token lifetime, Microsoft Entra ID / Azure awareness, security warnings and algorithm details. You can optionally verify the signature. Everything runs locally in your browser; the token is never uploaded or stored.
Paste a token into the box and decoding happens as you type. The inspector splits the compact form header.payload.signature into its three colour-coded parts and reads the JSON inside the first two. Nothing is sent anywhere: the token stays in your browser tab.
Values carry a colour. Green marks something reassuring, such as a valid signature or a token that is currently valid. Red marks a warning: an expired token, alg: none, a missing signature or another security problem. Grey is neutral information. The overall verdict in the summary card is rated Looks fine, Check carefully or Risky.
The findings are grouped into cards: Token status (algorithm, signature present, type, length), Token lifetime (issued at, not before, expiry, total lifetime, age and remaining time), Header, Payload with every claim explained, Signature, Algorithm details, Security warnings and, when detected, a Microsoft Entra ID card that extracts the tenant, application and object IDs. Use the search box to filter claims by name or value.
The Verify signature panel can check the token against its key. Choose Shared secret (HMAC) for HS256/384/512 and paste the secret, or Public key as PEM or JWK for RS/PS/ES/EdDSA algorithms. The check uses the browser’s built-in WebCrypto and the key never leaves your device. An unsecured token (alg: none) cannot be verified here — that is reported honestly.
The JSON tools card lets you copy, prettify, minify and download the payload JSON. The Export report section downloads the full result as Markdown or JSON, opens a print-ready A4 layout you can save as PDF, or copies the token. The report uses the same labels and language you see on screen.
The interface is available in English, German, French, Italian and Spanish, chosen from the menu in the corner. Everything is decoded in your browser: nothing is uploaded, logged or stored, which is why the app is marked green (Local). The counter in the corner is the same anonymous hit counter every tool in the suite uses. Questions or suggestions? Use the Feedback link — it opens the suite contact form with JWT Inspector pre-selected.