JWT Parser
Paste a JSON Web Token to decode its header and payload into readable JSON, and see whether the token has expired based on the exp claim. Decoding only, no signature verification.
FreeOnline Tool
Loading…
How to Use
- Paste a complete JWT into the input box; it should be three segments separated by dots.
- Click "Parse" and the decoded header and payload JSON appear separately below.
- If the payload contains an exp claim, the exact expiry time is also shown along with a valid or expired status.
- Click "Load sample data" to see the decode result for an example token.
Features
- Decodes the Base64Url-encoded header and payload segments into readable JSON.
- Reads the exp claim from the payload, converts it to your local time, and reports whether the token has already expired.
- Shows a clear error when the token is not a valid three-segment JWT or cannot be decoded.
- Runs entirely in the browser and performs only Base64 decoding and JSON parsing; it does not verify the signature.
Use Cases
Debugging login and authorization
While building JWT-based authentication, quickly inspect the user details and permission claims a token is carrying.
Chasing down expired tokens
When an endpoint returns 401 and you suspect expiry, paste the token to confirm the exact time its exp claim points to.
Checking what your backend issues
Verify that the algorithm in the header and the fields in the payload of a freshly issued token match your intended design.
Learning how JWTs are structured
Decode a real token to see the three-part header, payload, and signature layout and how Base64Url encoding works.
FAQ
Does this tool verify the JWT signature?
No. It only Base64-decodes the header and payload and displays them as JSON. It does not check the signature, so it cannot tell you whether a token has been tampered with or forged. Signature verification needs the secret key and belongs on your server.
Why do I see an "invalid JWT format" message?
A standard JWT consists of three dot-separated segments: header, payload, and signature. If your input is not in that three-part shape, for example a segment is missing, the format is reported as invalid.
What happens when the token has no exp claim?
Without an exp claim the tool simply shows the decoded header and payload and omits any expiry information.
Is the token I paste uploaded or logged?
No. All decoding happens locally in your browser and nothing is sent to a server. Even so, avoid pasting production tokens that carry sensitive claims while you are in a public place.