Utilities
JWT Inspector
Decode any JWT and actually verify its signature — locally.
Paste a JSON Web Token, see what's inside, and — unlike the web-based decoders — verify the signature without your token ever leaving your Mac.
Decode a token
- Open JWT Inspector.
- Paste the token (the long
xxxxx.yyyyy.zzzzzstring). - Instantly you get:
- Header — algorithm and token type
- Payload — every claim in a readable table, plus an interactive JSON tree
- Standard claims explained:
exp(expiry),iat(issued at),sub(subject), and friends, with human-readable dates
- Expired token? You'll see it flagged — no more mentally converting Unix timestamps.
Verify the signature
Decoding ≠ verifying, and this matters:
Decoded is not verified
Anyone can decode a JWT — the payload is just encoded, not encrypted. What proves a token is genuine is the signature. A token that decodes fine can still be forged. Never trust a JWT you haven't verified.
For HS256-signed tokens:
- Paste your secret into the verification field.
- The app recomputes the signature and compares — a real cryptographic check, done locally.
- ✓ valid means this token was signed with that secret. ✗ means it wasn't (or the token was tampered with).
Your token and secret stay in the app. Nothing is sent anywhere — worth remembering next time someone pastes a production JWT into a random website.
Copy pieces out
Header, payload, or any individual claim — one click copies it as JSON.