Decode a compact JWT locally and explore nested header and payload objects or arrays in a collapsible, type-aware tree without displaying verification as trust. Ideal for developers inspecting complex nested claims, custom JWT fields, and deep authorization structures in tokens.
JWT tools
Paste JWT to inspect
Header and payload will appear here.
Use a collapsible tree to understand nested JWT claim shape; this view shares the decoder’s three-segment JSON parser and intentionally does not establish authenticity.
Follow this implementation-specific workflow for JWT Tree Viewer; each step reflects the controls and limits in the current browser workspace.
Step 1
Paste the full three-section compact JWT or load the supplied sample; omit any Bearer prefix.
Step 2
Keep Live enabled for immediate parsing, or disable it and use View Tree after the input is complete.
Step 3
Run the parser, which Base64URL-decodes UTF-8 header and payload JSON using the shared JWT decoder.
Step 4
Expand nested objects and arrays by their disclosure controls and check every key’s displayed primitive type and value.
Step 5
Return to JWT Decoder for claim timing or send the unchanged token to JWT Verifier for supported HMAC verification.
Consequence: The tree renders attacker-controlled JSON just as readily as signed JSON and never calls the verification function.
Fix: Treat it as a structural debugger only and verify the unchanged compact token separately.
Consequence: Only decoded header and payload are passed to the renderer; the third segment is parsed by shared code but is not shown here.
Fix: Use JWT Decoder for signature-byte visualization or JWT Verifier for a supported HMAC verdict.
Consequence: Every nested value creates recursive React nodes and there is no enforced depth/key limit in this workspace, so rendering can stall the tab.
Fix: Inspect unusually large tokens in a controlled environment and avoid expanding branches that are not needed.
Decode a token, locate the exact nested claim and its JSON type, then validate authenticity and application policy before use.
The header and payload sections are valid Base64URL JSON objects; the literal signature section is structurally allowed but is not verified or displayed.
The root and first nested level initialize expanded; deeper object and array nodes start collapsed to limit visual noise.
No. It can reveal the claim’s type and nesting, but only the receiving application’s verified authorization policy gives that value meaning.
Yes. Arrays receive indexed child nodes and a collapsed item count, while objects receive named child nodes.
Five parts indicate compact JWE or another unsupported shape; the shared parser requires exactly three JWT/JWS sections.
It can be inspected as data, but it must not be trusted. The viewer provides no signature verdict and unsigned tokens require rejection unless an explicit safe protocol says otherwise.
Token text and the expanded tree remain in this browser and can work offline after caching. Clipboard access occurs only when you press Paste; the workspace does not upload the token or persist it as history.
