Parse and decode JSON Web Tokens (JWT) to inspect headers, payload claims, and expiration locally.
Loading tool
About JWT parser
Decodes a JSON Web Token into its header, payload and signature. Standard claims like iss, sub, aud and scope are labeled, time claims (exp, nbf, iat, auth_time) are shown as local, ISO and relative dates, and a badge tells you whether the token is expired or not yet valid. A leading 'Bearer ' prefix is stripped automatically. The signature is shown as Base64URL and hex but is not verified.
Common uses
- Check why an API returns 401 by reading the token's exp and aud claims
- See which roles or scopes an access token actually carries
- Identify the signing algorithm (alg) and key ID (kid) in the header
- Copy a decoded payload as formatted JSON into a bug report
FAQ
- Is a JWT encrypted?
- A standard signed JWT (JWS) is not encrypted. The header and payload are only Base64URL-encoded, so anyone holding the token can read them; the signature only proves they were not modified. Encrypted tokens (JWE) have five parts and cannot be decoded without the key.
- Does this tool verify the signature?
- No. It only decodes the token. Signature verification needs the issuer's secret or public key and should be done on your server.
- What format is the exp claim in?
- exp, nbf and iat are NumericDate values: seconds (not milliseconds) since the Unix epoch, 1970-01-01T00:00:00Z.
- Is it safe to paste a production token?
- Decoding runs entirely in your browser and the token is not sent anywhere. A valid token is still a credential, so avoid pasting live tokens into tools you do not trust.