API Payload Inspector

About this tool

Understand an unfamiliar API response in seconds. Paste a JSON payload to list every path in it with its type and an example value, plus its size in bytes, nesting depth and key count. Paste a JSON Web Token instead to read its header and payload, decoded without verifying the signature.

How it works

• Each path is written from the top ($), with .key for normal keys, ["key"] for keys with spaces or symbols, and [*] for array items. Choose "List every index" to see [0], [1] and so on.
• When array items differ, all the types found at a path are shown, for example string | null, which tells you a field is optional.
• Size is counted in UTF-8 bytes, as pasted and minified. Depth counts nested objects and arrays, and the key count adds up the keys of every object.
• A JWT is split at its dots and the header and payload are decoded from Base64URL. Time claims (iat, nbf, exp) are shown in UTC and checked against your device's clock.

Common questions

Does this check that a JWT is genuine?

No. Decoding only reads the content, and anyone can create a token with any content. Only your server, with the right key or secret, can verify the signature, so never trust a decoded token for access decisions.

Is it safe to paste a real token?

The token is decoded in your browser and not sent to us, but a live token can still give access to an account. Prefer an expired or test token, and never paste tokens into tools you do not trust.

Why are some array paths shown once with [*]?

Merging array items keeps the list short for large responses. Every item is still read, so the types shown cover all items.