JWT Parser
WebDecode and inspect JWT tokens (header, payload, expiry) with signature check. Inspect auth claims and expiry without sending secrets anywhere.
About JWT Parser
A JWT (JSON Web Token) is a compact, URL-safe token format consisting of three Base64URL-encoded segments — Header, Payload, and Signature — joined by dots. This tool parses the header and payload of a JWT locally in your browser and displays expiry information. **It does not verify signatures or decrypt anything** — your token never leaves your device. Tip: Bookmark this tool for quick access during your web development work. All processing happens locally in your browser with no installation required.
How to Use
- Open the JWT Parser tool
- Paste the complete JWT string into the input field
- Header and Payload are automatically decoded and displayed as JSON
- Check expiration time, issued at time, and other key info
- Enter the secret key to verify the signature (HS256/384/512 only)
Use Cases
- Debug login state — When users report "login expired", paste the token to inspect expiry time and claims.
- Inspect OAuth / OIDC flows — Examine claims (sub, aud, iss, etc.) inside access_token and id_token issued by an identity provider.
- Validate token structure — Confirm a backend-issued token contains expected custom fields like user_id or role.
- Understand third-party SSO — Study tokens issued by Auth0, Firebase, Okta, or other identity providers.
- Troubleshoot 401 errors — Quickly see whether the token has expired (exp claim) or is not yet valid (nbf claim).
- Custom claim validation — Verify that your backend includes expected custom claims like permissions, tenant_id, or feature flags in the token payload.
- Token size audit — Measure the decoded payload size to identify unnecessarily large tokens that could impact request performance.
FAQ
Is a JWT encrypted?
No. JWTs are only Base64URL encoded by default (not encrypted) — anyone who gets the token can decode and read the payload. Use JWE for confidentiality, or simply do not put secrets in a JWT.
Does this tool verify the signature?
No. Signature verification requires the server's key or public key. This tool only decodes and displays. In production, verify on the backend using libraries like jose or jsonwebtoken.
How do I manually invalidate a JWT?
You cannot — without a server-side blocklist. This is an inherent JWT limitation, which is why access_tokens typically have short lifetimes (minutes) and are paired with refresh_tokens.
Are JWTs more secure than session cookies?
Not necessarily. JWTs suit stateless distributed systems, but HttpOnly + Secure session cookies are also safe. The choice depends on architecture, not security level.
Why is my JWT so long?
The bigger the payload, the bigger the token. Include only essential claims (sub, exp, aud, role). Since the token is sent on every request, oversized JWTs waste bandwidth.
Any browser compatibility requirements?
This tool works in all modern browsers (Chrome, Firefox, Edge, Safari). No plugins or extensions required.
Can I use it offline?
After initial load, most features work offline. The core logic runs entirely in your browser with no network dependency.
Comments
Comments are stored locally in your browser. Configure Giscus for cloud-based comments.