JWT parser
Parse and decode your JSON Web Token (jwt) and display its content.
About JWT parser
A JSON Web Token (JWT) is three Base64URL-encoded parts joined by dots: a header, a payload of claims, and a signature. This tool decodes the header and payload so you can read them, and shows what each standard claim means.
When you would use it
- Checking why an API returns 401: is the token expired, issued for another audience, or missing the scope you expected?
- Inspecting the tokens your login flow hands out to see which claims (sub, roles, tenant) the backend actually receives.
- Reading the iat, nbf and exp claims as dates instead of Unix timestamps while debugging clock-skew problems.
How to use it
- Paste the whole token (the three dot-separated parts) into the field.
- Read the header to see the signing algorithm (alg) and token type.
- Read the payload; exp, nbf and iat are also shown as local dates next to the raw number.
Things worth knowing
- This tool only decodes. It does not verify the signature, so a readable token is not proof that it is genuine. Verify signatures on your server, or use the JWT signer tool here.
- The payload is encoded, not encrypted: anyone who holds the token can read it. Never put passwords or other secrets in claims.
- Decoding happens in your browser and the token is not sent anywhere. Even so, treat a live production token like a password and prefer expired or test tokens when you can.
- Dates are shown in your device's time zone, while exp and iat are always UTC-based Unix seconds.
Frequently asked questions
- Why does my token fail to decode?
- A valid JWT has exactly three dot-separated parts and each of the first two must be Base64URL-encoded JSON. Common causes are a leftover "Bearer " prefix, a truncated copy, or an opaque token (such as a random string) that is not a JWT at all.
- Is it safe to paste a token here?
- The decoding runs locally in the page and nothing is uploaded. If the token is still valid, it can be used by anyone who sees it, so avoid pasting it into screenshots, chats or any site that sends data to a server.