JWT parser

A JSON Web Token looks like random text, but its first two parts are simply Base64URL-encoded JSON. Decoding them shows which algorithm signed the token, who issued it, who it belongs to and when it expires. That is the first step when debugging login problems, 401 Unauthorized errors or OAuth integrations. This parser decodes the token and explains the claims.

How to use it

1. Paste the token, the long string starting with eyJ.
2. Read the decoded header and payload.
3. Check the timestamps for expiry and validity.

Anatomy of a JWT

header.payload.signature

• Header: alg (such as HS256 or RS256), typ and often kid, the ID of the key used.
• Payload: claims such as iss issuer, sub subject, aud audience, exp expiry, nbf not before, iat issued at and jti token ID, plus custom claims such as roles or scopes.
• Signature: proves the header and payload were created by the key holder.

Debugging checklist

• Expired: compare exp with the current time. It is in seconds since 1970.
• Wrong audience: the API checks that aud matches its own identifier.
• Wrong issuer: tokens from a staging identity provider will fail in production.
• Clock skew: if nbf or iat is a few seconds in the future, server clocks may differ.
• Missing scopes or roles cause 403 Forbidden rather than 401.

Decoding is not verifying

This tool reads the token; it does not prove the token is genuine. Servers must verify the signature with the right key and must reject tokens with alg: none. Treat tokens as passwords: decoding happens locally here, but do not paste live production tokens into tools you do not trust.