JWT Parser
Decode a JSON Web Token's header and payload to inspect its claims and check expiration - no verification, no server round-trip.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Subject (sub): 1234567890
Issued At (iat): 1/18/2018, 1:30:22 AM
Signature (not verified)
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Recommended Settings
Pro Tips
- •This tool only decodes the token's contents - it never verifies the signature, since that requires the secret key or public key the token was signed with
- •Never trust an unverified JWT's claims for security decisions - decoding shows you what a token claims, not whether it's genuine
- •Standard registered claims like exp, iat, and sub are labeled with their full names to make the payload easier to read
- •Anyone can decode a JWT's header and payload, since they're just Base64URL-encoded JSON, not encrypted - never put secret data directly in a JWT payload
Most Popular
Most developers paste an access token here just to quickly check its expiration time and claims during debugging
When to Use This Tool
See exactly what data and claims are encoded inside an access or ID token.
Quickly check a token's exp claim against the current time.
Inspect a JWT's header and payload to diagnose an unexpected auth failure.
See how a JWT's three parts (header, payload, signature) are structured.
How It Works
Split the token into its three dot-separated parts: header, payload, and signature
Base64URL-decode the header and payload segments and parse them as JSON
Display the decoded claims, along with a plain-language expiration status if an exp claim is present
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Client-side Base64URL decoding for optimal performance on modern browsers.
Open Source
Built with verified, open-source libraries. Fully transparent.
Frequently Asked Questions
Does this verify the token's signature?
No. Verifying a signature requires the secret or public key the token was signed with, which this tool never has. It only decodes the readable header and payload.
Can I trust a decoded token's claims?
Only if you've separately verified the signature using the correct key. Anyone can create a JWT with any claims they like - the signature is what proves it's genuine.
Why can't I read the signature?
The signature isn't meant to be human-readable - it's a cryptographic value used only for verification, not for storing information.
Is my token sent to a server?
No. All decoding happens locally in your browser - your token is never transmitted anywhere.