JWT Parser

Split a token into readable parts.

FREE · NO SIGN-UP · RUNS ON YOUR DEVICE

The token stays in this tab

  • 3PARTS SPLIT
  • 2DECODED AS JSON
  • 3CLAIMS AS DATES
  • 0SECRETS ASKED FOR
Specification

JWT Parser at a glance

Parses
Header, payload, signature
Timestamps
exp, iat and nbf as dates
Signature
Shown, never checked
Encoding
Base64url, padding optional
Broken tokens
Names the part that failed
Price
Free
Account required
None
Where it runs
On your device
How to

How to use JWT Parser

  1. 1

    Paste the token

    Paste the token.

  2. 2

    Read the parts

    Read header and payload.

  3. 3

    Check the timestamps

    Check the timestamps.

Questions

Frequently asked questions

Does parsing verify the token?

No. Parsing reads what a token says. Verifying needs the signing key, which belongs on your server, and this page will never ask you for one.

Why can I read the payload at all?

A payload is base64url encoded, not encrypted. Anyone holding the token can read it, so nothing secret should be put in one.

What are the three parts?

Header, payload and signature, separated by dots. The first two are base64url JSON; the third is bytes produced with the signing key.

The token will not parse. Why?

Usually a character was lost in copying, or a dot is missing. The page names the part that failed to decode, so you can look at that piece.

Background

Reading a token, and trusting one

Paste a token and its three dot-separated parts are pulled apart. The header and payload are printed as JSON; the signature is shown as it stands, and left unchecked.

  • The dots are the only structure: three base64url segments, no more.
  • An expired token still parses, so the expiry is shown as a date rather than a verdict.
  • A payload should be treated as public, because holding the token is all it takes to read it.
  • Signature checking belongs where the key is kept, not in a browser tab.

Full specification

Specification of the JWT Parser tool
ParsesThe three dot-separated parts of a token, header and payload decoded into JSON.
TimestampsExpiry, issued at and not before, printed as dates with how long ago or ahead.
SignaturePrinted as it appears in the token. It is not checked, and no key is requested.
EncodingBase64url, including tokens whose padding has been stripped.
Broken tokensThe part that failed to decode is named instead of an error trace.
PriceFree. Supported by clearly labelled ads placed outside the working area.
Account requiredNo.
Where it runsIn your browser tab. Nothing is sent anywhere.
Next step

Keep going with the same files

All developer tools: Developer tools on SPOTTOOLS