JWT Decoder & Bearer Token Inspector
Safely decode, verify timestamps, and inspect JSON Web Tokens offline. Zero transmission to remote servers—safe for confidential corporate tokens.
{
"iss": "https://auth.nazamos.com/",
"sub": "auth0|64bf912903e",
"aud": [
"https://api.nazamos.com",
"https://auth.nazamos.com/userinfo"
],
"iat": 1788939900,
"exp": 1788943800,
"email": "alex.developer@enterprise.io",
"email_verified": true,
"roles": [
"admin",
"security_engineer"
],
"permissions": [
"read:telemetry",
"write:deployments",
"admin:tokens"
],
"scope": "openid profile email"
}100% Zero-Egress Privacy
Never paste production API tokens or enterprise customer data into ad-heavy remote servers. Nazamos runs 100% locally in your browser with zero network requests.
Live Expiration Clock
Real-time countdown timer tracking token validity down to the exact second, humanizing UNIX timestamps into local time and relative expiry.
Instant TypeScript Types
Automatically extract token claims into a strictly typed TypeScript interface, ready to paste directly into your Next.js or React authentication handlers.
JWT Registered Claims Reference
Standard claims defined by RFC 7519 that are commonly found in JSON Web Tokens:
| Claim | Full Name | Description |
|---|---|---|
| sub | Subject | Identifies the principal (user ID or entity) the token is about |
| iss | Issuer | Identifies the authorization server or identity provider issuing the JWT |
| aud | Audience | Identifies the intended recipient services (API endpoints) for the token |
| exp | Expiration Time | UNIX timestamp identifying when the token must no longer be accepted |
| iat | Issued At | UNIX timestamp identifying the creation time of the token |
| nbf | Not Before | Identifies the time before which the JWT must not be processed |
| jti | JWT ID | Unique identifier for the token to prevent replay attacks |
Verifying JWT Signatures on the Backend (Node.js & Go)
Never verify sensitive signatures on third-party web tools. Use secure backend libraries with your public key:
import jwt from "jsonwebtoken";
// Verify using secret or public key
const decoded = jwt.verify(token, process.env.JWT_SECRET, {
algorithms: ["RS256", "HS256"],
});
console.log("Verified User:", decoded.sub);token, err := jwt.Parse(tokenString, func(t *jwt.Token) (interface{}, error) {
return mySigningKey, nil
})
if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
fmt.Println(claims["sub"])
}