JWT Parser

Decode and inspect JSON Web Tokens (JWT) with real-time validation. View header, payload, and signature information securely in your browser.

Enter JWT Token

How to Use the JWT Parser

Paste Token

Paste your JWT token in the input area

Auto Decode

Token automatically decodes on paste

Inspect Parts

View header, payload, and signature data

Check Status

Verify token validity and expiration time

Understanding JWT Tokens

What is a JWT?

JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. It consists of three parts: header, payload, and signature, separated by dots and base64url encoded.

• Header: Contains token type and signing algorithm
• Payload: Contains claims or user data
• Signature: Verifies token wasn't tampered with
• Stateless: No server-side session storage needed

Why Parse JWTs?

JWT parsing is essential for debugging authentication issues, verifying token contents, checking expiration times, and understanding what data is being transmitted in tokens.

• Debugging: Inspect token contents during development
• Security: Verify token structure and claims
• Expiration: Check token validity period
• Development: Understand authentication flow

Standard JWT Claims Reference

Registered claim names defined by RFC 7519 that you will see in almost every token payload.

Claim	Full Name	Meaning
iss	Issuer	Who created and signed the token
sub	Subject	Who the token is about — usually the user ID
aud	Audience	Who the token is intended for (a client or API)
exp	Expiration	Unix timestamp after which the token must be rejected
nbf	Not Before	Unix timestamp before which the token is invalid
iat	Issued At	Unix timestamp of when the token was created
jti	JWT ID	Unique identifier, useful for revocation lists

Common JWT Algorithms

• HS256 (HMAC + SHA-256): Symmetric — one shared secret signs and verifies. Simple, but anyone holding the secret can forge tokens.
• RS256 (RSA + SHA-256): Asymmetric — private key signs, public key verifies. The standard choice for distributed systems.
• ES256 (ECDSA + SHA-256): Asymmetric like RS256 but with much shorter signatures — a good modern default.
• none: Unsigned token. Must be rejected by any serious verifier; historically the source of critical bypass vulnerabilities.

Safety Notes

• Never paste production tokens into unknown tools. This parser runs entirely in your browser (check: it works offline), but that is not true of every site.
• A JWT is not encrypted. The payload is only base64url-encoded — anyone who has the token can read it. Never store secrets in claims.
• Decoding is not verifying. A valid-looking structure says nothing about the signature. Verification requires the key, which never leaves your auth server.
• Check exp server-side. Rejecting expired tokens is the verifier's job, not the client's.

Instant Decoding

Auto-decode JWT on paste with color-coded sections.

100% Private

All decoding happens in your browser. Tokens never leave your device.

Completely Free

No registration or limits. Parse JWT tokens freely anytime.

JWT Parser FAQ

Is it safe to paste a JWT into this tool?

Yes. Decoding runs entirely in your browser with no network calls — you can verify this by disconnecting from the internet and reloading the page. Even so, avoid pasting production tokens anywhere as general hygiene.

Does parsing a JWT verify its signature?

No. Parsing only base64url-decodes the header and payload. Verifying the signature requires the signing key (HMAC secret or public key), which only your auth server holds.

Why can anyone read my JWT payload?

JWT payloads are encoded, not encrypted. Anyone holding the token can decode and read the claims — that is by design. Never store secrets or sensitive data inside a JWT payload.

How do I know when a token expires?

Check the exp claim — a Unix timestamp after which the token must be rejected. This parser highlights token status (active, expired, or not yet valid) based on exp and nbf automatically.

JWT Parser

Header

Payload

Signature

Invalid Token