JWT Parser
Decode JWT header and payload instantly. The signature is shown but never verified—your secret never leaves this page.
A JSON Web Token is a compact, URL-safe token with three base64url segments: header, payload, and signature. The payload carries claims such as subject, issuer, and expiry.
This tool decodes the header and payload so you can inspect claims. It intentionally does not verify the signature on a server—doing so would require sending your signing secret or the token to a third party, which defeats the purpose.
The 'exp' claim is in seconds since the Unix epoch, not milliseconds. The badge reads 'expired' once the current time passes that value.
Common uses
- Reading the expiry or issued-at claims of an access token during debugging without calling an external service.
- Checking that a custom claim or role was included in the payload after a login flow change.
Frequently asked questions
- Is it safe to paste my JWT here?
- Yes, because parsing happens entirely in your browser and nothing is sent anywhere. However, never share a production token publicly—treat it like a password.
- Why does the signature show 'not verified'?
- Verification requires the secret or public key, which you should not paste into a website. We show the signature bytes but leave verification to your server.
- What does the exp claim mean?
- exp is the expiry time in seconds since the Unix epoch. The badge turns 'expired' once the current time passes that value.
- Why show the signature?
- So you can confirm the token structure is complete. Verification is deliberately left to your server to avoid exposing secrets.