Video guide · 14 seconds
Watch: decode a JWT
No sound. Each step is captioned on screen and also written out in the guide below.
Data & developer tools Auth
JWT Inspector
Decode a JSON Web Token locally, inspect its claims, and understand what it contains without verifying or sharing it.
Workspace
Inspect a token locally
Runs locally in your browser. Your token is not uploaded, saved, or included in sharing.
A JWT normally has three dot-separated parts: header, payload, and signature.
Decode only. Signature verification requires a trusted key.
Decoded token
Header
Header JSON will appear here.
Payload
Payload JSON will appear here.
Signature
Signature text will appear here.
Quick view
Standard claims
A quick guide
Read a token in three parts
- 01Paste the token
Keep the three segments separated by dots.
- 02Decode locally
BytesBench parses the Base64URL header and payload in your browser.
- 03Inspect claims
Review standard timestamps and copy the readable report.
Security note
Decoding is not verification
header.payload.signatureAnyone can decode a JWT. This tool does not verify signatures, validate trust, or tell you whether a token should be accepted.
Good to know
Frequently asked questions
Does this verify the JWT signature?
No. BytesBench only decodes the header and payload and displays the signature text. Verification requires the correct algorithm, trusted key, and application context.
What are exp, iat, and nbf?
They are common NumericDate claims: expiration time, issued-at time, and not-before time. BytesBench displays their raw values and UTC timestamps when they are numeric.
Is a JWT encrypted?
Usually no. Signed JWT payloads are encoded, not encrypted, so do not place secrets or sensitive data in them unless your system explicitly uses an encrypted token format.