What is JWT Parser?
JWT Parser reads the header and payload of compact tokens so developers can inspect algorithms, subjects, audiences, and time claims. It performs Base64URL and JSON decoding only: it does not verify the signature or prove that a trusted issuer created the token. Treat every decoded claim as untrusted until server-side cryptographic validation succeeds. Common workflows include the following. Debug JWT claims during an authentication flow. Inspect exp, iat, and nbf time fields. Confirm that a received token has the expected three-part structure. The page also documents input boundaries, output behavior, and practical cautions so you can review the result before putting it into an application, configuration, test, or production workflow.
When to use it
- Debug JWT claims during an authentication flow.
- Inspect exp, iat, and nbf time fields.
- Confirm that a received token has the expected three-part structure.
How to use it
- Paste a three-segment JWT.
- Decode the header and payload locally.
- Treat the result as untrusted until another system verifies the signature and claims.
- Load one of the realistic examples first to verify the selected options and processing direction before replacing it with your own data.
- Review the output, status message, and documented limits; copy, download, or continue only after the result matches your expectation.
Runnable examples
The “Example 1” and “Example 2” buttons load the matching inputs. They cover different structures, directions, or boundaries and can be run directly in the workspace.
Example 1
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEwMSIsIm5hbWUiOiJKU09OTGFuZSIsInJvbGVzIjpbImVkaXRvciIsInJldmlld2VyIl0sImlhdCI6MTUxNjIzOTAyMn0.signatureExample 2
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJsb2NhbC10ZXN0IiwiYXVkIjpbIndlYiIsImFwaSJdLCJleHAiOjE4MDAwMDAwMDAsImZlYXR1cmVzIjp7ImRhcmtNb2RlIjp0cnVlfX0.Input rules
- Only compact JWTs with three dot-separated segments are accepted.
- The header and payload must decode to valid UTF-8 JSON.
- Protect production tokens from screenshots and clipboard exposure even though the page does not upload them.
- Text input is counted before processing and is limited to 100,000 characters on this page; file modes apply the separate file limit shown in the workspace.
- Only compact three-segment JWTs are accepted.
Output rules
- Header and payload JSON are formatted separately.
- Common NumericDate claims include readable time information.
- The signature is never verified and the result is labeled accordingly.
- Output reflects only the current input, direction, and options; rerun after changing a mode or value instead of treating an earlier result as current.
- Signatures, issuer, audience, expiry validity, and cryptographic trust are not verified.
Limitations and cautions
- Only compact three-segment JWTs are accepted.
- Signatures, issuer, audience, expiry validity, and cryptographic trust are not verified.
- Decoded claims may be attacker-controlled and must not be treated as authenticated.
How your data is handled
The token is split and decoded only in the current browser. It is not uploaded, logged, or checked by a remote service.