JWT Parser

Decode and inspect JWT tokens — view header, payload, and signature structure.

DecodeJWTInspect
Valid JWT
JWT Input
193 chars
Token Parts

Header

alg: HS256 | typ: JWT

Payload (Sample)

sub: user_123
name: Jane Developer
email: jane@example.com
...

Signature

SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Header
Payload

All JWT decoding happens locally in your browser — your data never leaves your device.

A JWT (JSON Web Token) is three Base64URL-encoded segments joined by dots: header.payload.signature. This parser splits the token, Base64URL-decodes the first two segments and shows the header and payload as pretty-printed JSON in two read-only editors, each with its own copy button. It is the quickest way to get the exact JSON inside a token into your code, a test fixture or a bug report.

Values are shown exactly as they appear in the token. Timestamps such as exp and iat stay as raw Unix seconds, and claims are not annotated or checked. A small Token Parts panel next to the input gives a quick summary: the alg and typ header values, the first three payload claims, and the raw signature string.

If you want claim explanations, readable dates and an expired/valid check, use the JWT Decoder instead. To convert a raw exp or iat value by hand, paste it into the Timestamp Converter.

  1. Paste the token into the JWT Input box. Parsing happens as you type.
  2. Confirm the status bar reads "Valid JWT", meaning the token has three parts and the header and payload decode to JSON.
  3. Glance at the Token Parts panel for the algorithm, token type and the first few claims.
  4. Copy the formatted JSON from the Header or Payload panel with its copy button.
  5. Click Clear to remove the token from the page.

  • Header and payload rendered as formatted JSON in read-only code editors
  • Separate copy buttons for header JSON, payload JSON and the original token
  • Token Parts summary: alg, typ, first three claims and the raw signature
  • Shows the underlying decode error message when a segment is not valid Base64URL or JSON
  • Live parsing with no button to press
  • Runs in your browser; the token is not uploaded

Extracting the header and payload

Input:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEyMyIsImV4cCI6MTcwOTM0MjQwMH0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header:
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload:
{
  "sub": "user_123",
  "exp": 1709342400
}

The exp claim is left as the raw number 1709342400 (2024-03-02 01:20 UTC); the parser does not convert or evaluate it.

Decoding one segment by hand

Segment:  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
Base64URL -> Base64: replace - with +, _ with /, pad with = to a multiple of 4
Decoded:  {"alg":"HS256","typ":"JWT"}

This is the same transformation the parser applies to the header and payload before parsing them as JSON.

Invalid JWT format. JWT must have three parts separated by dots.

The token was truncated, is an opaque (non-JWT) access token, or is a five-part encrypted JWE.

Copy the complete token from its source. A signed JWT always contains exactly two dots.

Decode error: Failed to execute 'atob' ... The string to be decoded is not correctly encoded.

A segment contains characters outside the Base64URL alphabet, such as surrounding quotes, a trailing comma, or URL-encoded characters (%2E) from a query string.

Paste only the raw token value. URL-decode it first with the URL decoder if it came from a link.

Decode error: Unexpected token ... is not valid JSON

The segment decodes but the result is not JSON. A common cause is pasting the whole Authorization header value, so "Bearer " becomes part of the first segment; a corrupted or non-JWT string has the same effect.

Remove the "Bearer " prefix and recopy the token. The header and payload of a JWT must both decode to JSON objects.

What is the difference between the JWT Parser and the JWT Decoder?

Both decode the same header and payload locally. The parser shows them as raw JSON side by side for copying. The JWT Decoder adds a claim-by-claim view with explanations of standard claims, converts exp, iat and nbf to dates, and shows whether the token has expired.

Does "Valid JWT" mean the token is trustworthy?

No. It only means the token has three parts and the header and payload decode to JSON. The signature is not verified and expiry is not checked, so a forged or expired token can still show "Valid JWT". Verify tokens on the server with the issuer's secret or public key.

Is the payload encrypted?

No. In a standard signed JWT the payload is only Base64URL-encoded, so anyone holding the token can read it. Do not put secrets or sensitive personal data in JWT claims unless you use encrypted tokens (JWE), which this tool cannot read.

How do I parse a JWT in code without a library?

Split on ".", take the second segment, convert Base64URL to Base64 (replace - with + and _ with /, then pad with =), decode it and JSON.parse the result. In Node.js, Buffer.from(segment, "base64url").toString("utf8") handles the conversion and UTF-8 in one step. Use a proper JWT library whenever you also need to verify the signature.

Why is the signature not decoded?

The signature is raw binary output of the signing algorithm (an HMAC or a digital signature), not JSON, so there is nothing readable to show. It is displayed as the original Base64URL string.