JWT Claim Visualizer
Decode a JWT's header, payload and signature locally, group claims into registered, public and private, and see expiry status, remaining validity and the iat/nbf/exp timeline at a glance.
FreeOnline Tool
Loading…
How to Use
Paste a JWT token (the three-part header.payload.signature string) into the box and it is decoded automatically. The result shows the three token parts, the formatted header JSON, an expiry status card (valid or expired with expiry time and remaining validity), timeline cards for iat, nbf and exp, and the payload claims grouped into Registered Claims, Public Claims and Private Claims, with descriptions for standard claims. Use 'Load valid JWT sample' or 'Load expired JWT sample' to try it, or 'Clear' to reset.
Features
- Decodes and displays the header, payload and signature parts separately
- Groups claims automatically into registered, public and private categories
- Shows expiry status, expiry time and remaining validity clearly
- Timeline cards for iat (issued at), nbf (not before) and exp (expires)
- Standard registered claims come with explanations; parsing happens as you type
Use Cases
Debug login sessions
Paste a user's JWT when they report being logged out to check exp and remaining validity, and see whether it expired or was never valid
Diagnose 401 errors
Decode the token when the API rejects it and check whether iss, aud and exp match the server's validation rules
Learn JWT internals
Use the sample tokens to understand the header, payload and signature parts and the meaning of standard claims
Integrate SSO
When connecting third-party SSO, inspect which claims their token carries and confirm the names of custom fields
FAQ
Is my token uploaded?
No. Decoding happens entirely in your browser, so you can safely paste production tokens
What are registered, public and private claims?
Registered claims (iss, exp, iat) have standardized meanings; public claims (email, username) use agreed names; private claims are custom fields agreed between parties. The tool groups them accordingly
Why does parsing fail?
Usually the pasted value is not a complete three-part JWT (missing dots) or one part is not valid Base64 or JSON. Check the token format
Does it verify the signature?
No, verifying a signature requires the secret key. The tool only decodes the structure and displays claims; it does not validate authenticity