How to Use the JWT Parser & Validator
- Paste a JWT (three Base64URL segments separated by dots) into the token field. The header and payload decode instantly as formatted JSON.
- Check the claim timeline: the tool flags expired tokens (exp), not-yet-valid tokens (nbf) and future issued-at (iat) values against your current local time.
- Optionally enter your HMAC secret to verify the signature using HS256/HS384/HS512 (via the Web Crypto API). The secret stays in your browser — it is never transmitted.
What Is JWT Parser?
A JSON Web Token (JWT) is a compact, URL-safe token format used to carry claims between parties. A JWT consists of three Base64URL-encoded segments joined by dots: the header (algorithm and token type), the payload (the claims, such as subject and expiration), and the signature.
The signature is what makes a JWT trustworthy. For HMAC tokens (alg: HS256, HS384 or HS512), the signature is computed as HMAC of the header and payload using a shared secret. Anyone can decode the payload — it is not encrypted — but only someone holding the secret can produce a valid signature. That is why decoding a JWT tells you what it says, while verifying the signature tells you whether it was tampered with.
Standard registered claims include exp (expiration time), nbf (not before), iat (issued at), iss (issuer), aud (audience) and sub (subject). Applications reject tokens whose exp has passed or whose nbf is in the future, usually with a small leeway window for clock skew.
Developers decode JWTs constantly while debugging authentication: checking why an API returns 401, inspecting custom claims, or confirming that a token from a staging identity provider has the expected shape. Because tokens often carry session data and secrets must be protected, doing this locally — rather than pasting secrets into an unknown website — is the security-conscious choice, which is why this tool performs all cryptographic work in your browser with the Web Crypto API.
Common Use Cases
- Debugging 401/403 responses. Decode the token from your Authorization header to see whether it expired, lacks expected claims, or comes from the wrong issuer.
- Verifying token integrity. Enter your HMAC secret to confirm the signature matches — useful when testing your own signing code or webhook tokens.
- Inspecting OAuth/OIDC tokens. Read issuer, audience, scope and session claims from ID tokens issued by identity providers during login flows.
- Learning the JWT format. See header, payload and signature side by side with timestamps rendered as human-readable dates.
- QA across environments. Compare tokens from dev, staging and production claim sets without sharing secrets with a third party.
Frequently Asked Questions
Is it safe to paste my JWT here?
The token and any secret you enter stay in your browser. Decoding uses local JavaScript and signature verification uses the built-in Web Crypto API; nothing is uploaded, logged or stored. For maximum safety you can also use the tool offline.
What is the difference between decoding and verifying a JWT?
Decoding simply Base64URL-decodes the header and payload so you can read the claims — anyone can do it. Verifying recomputes the signature with your secret and compares it, proving the token was not altered and was signed by someone who holds the key.
Which signature algorithms are supported?
The tool verifies HMAC algorithms HS256, HS384 and HS512 using the Web Crypto API. RSA/ECDSA (RS256, ES256) tokens are decoded and their claims validated, but public-key verification is not performed in this version.
Why can everyone read my JWT payload?
JWTs are encoded, not encrypted. Base64URL only makes data URL-safe; it provides no secrecy. Never put passwords or sensitive data in claims — use JWE (encrypted tokens) if the payload must stay confidential.
What does "expired" vs "not yet valid" mean?
A token is expired when the current time is past its exp claim. It is "not yet valid" when the current time is before its nbf (not before) claim. Both normally cause servers to reject the token, often with a small clock-skew leeway.