What causes an 'Invalid JWT Format' error?

A standard JSON Web Token consists of exactly three Base64URL-encoded segments separated by two dots (.): header.payload.signature. If your token contains extra spaces, missing segments, or invalid characters, the parser will flag a format error.

How does the expiration (exp) calculation work?

The standard JWT 'exp' claim stores a Unix timestamp in seconds. Crefims compares this timestamp to your system's current time to display whether the token is currently active or expired, alongside an exact countdown timer.

Can I verify RSA (RS256) signatures here?

This tool supports HMAC-SHA256 (HS256) symmetric signature verification directly in the browser via Web Crypto. Asymmetric public key verification (RS256/ES256) requires PEM certificate parsing, which is planned in an upcoming release.

Does this tool work with emojis and non-ASCII characters in claims?

Yes. Our Base64URL decoder properly unescapes multi-byte UTF-8 sequences, ensuring international names, unicode characters, and emojis render accurately without character corruption.

Private JWT Token Decoder & Inspector

Decode, inspect, and verify JSON Web Tokens (JWT) client-side. Check expiration timestamps, header, payload, and HS256 signatures with 100% privacy.

Capabilities

Key Features

100% client-side decoding with zero network requests or analytics tracking
Color-coded three-part JWT segmentation (Header, Payload, and Signature)
Real-time expiration countdown with human-readable timestamps (exp, iat, nbf)
Built-in HMAC-SHA256 signature verifier using the native Web Crypto API
Proper UTF-8 and Unicode character decoding for all payload claims
Formatted JSON viewing with one-click claim copying and payload extraction
Sample token library covering standard OAuth, Firebase, and expired sessions
Dark and light theme support with responsive high-contrast typography

Quick Guide

How to use

Paste your JWT string

Paste an encoded JSON Web Token into the input area, or select one of the provided sample tokens to test.

Inspect Header & Payload claims

Review the decoded Header algorithm and Payload claims. Examine key identifiers like sub, iss, aud, and custom scopes.

Verify token validity and expiration

Check the visual expiration badge to determine if the token is active or expired, along with exact local timestamps.

Test HMAC-SHA256 signature (optional)

Enter your secret key in the verification panel to confirm whether the signature matches using client-side cryptographic hashing.

Technical Guide

About Private JWT Token Decoder & Inspector

Private JWT Decoder & Inspector is a client-side security utility that decodes, parses, and debugs JSON Web Tokens (JWT) directly inside your web browser. Unlike conventional web decoders that transmit tokens across remote servers, Crefims processes all token strings locally through native browser APIs. Inspect header algorithms, explore payload claims, track real-time expiration countdowns, and verify HMAC-SHA256 signatures with zero data leakage.

FAQ

Frequently Asked Questions

Yes. Crefims executes 100% locally in your browser. Tokens are never uploaded to any backend server, logged in any database, or cached in external analytics. You can even disconnect your internet connection and the decoder will continue to work normally.

Related Tools

Browse all