How to use this tool
- Paste a compact, three-segment JWT.
- Inspect decoded header and payload as untrusted data.
- Compare exp, nbf and iat against your browser clock, then clear the token.
Inspect an explicitly unsigned, expired JWT
Debug the structure of a synthetic token without treating the decoded claims as proof of identity.
Input
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJzeW50aGV0aWMtdXNlciIsImV4cCI6MX0.
Expected output
{
"header": {
"alg": "none",
"typ": "JWT"
},
"payload": {
"sub": "synthetic-user",
"exp": 1
}
}The header says alg=none, the signature is empty, and exp=1 is 1970-01-01T00:00:01Z. The inspector warns that it is unsigned, expired and NOT signature-verified. Real authorization requires trusted keys, an algorithm policy, issuer, audience and timing validation.
More examples
- NumericDate 0 represents 1970-01-01T00:00:00.000Z.
- An alg value of none means the token claims to be unsigned.
- An expired exp value can be displayed even when the signature is invalid.
Know the limits
Decoded, NOT signature-verified; claims are untrusted. A malicious actor can rewrite a token’s claims. Do not use this output to authorize anything.
Common questions
Does decoding prove a token is valid?
No. Validation requires verifying the signature with a trusted key and checking allowed algorithms, issuer, audience and timing.
Will jku or x5u URLs be visited?
No. This inspector never resolves token-provided URLs.