JWT Parser & Token Debugger
Secure client-side JSON Web Token (JWT) decoder. Inspect claims, subject, issuer, signature algorithm, and live expiration time without sharing your token with third-party servers.
Step-by-Step Instructions
Paste Encoded JWT Token
Paste your compact JSON Web Token (`header.payload.signature`) into the decoder.
Inspect Decoded Header & Claims
Instantly view decoded JSON Header (algorithm, token type) and Payload claims in formatted JSON.
Verify Token Expiration & Timestamps
Examine human-readable UTC conversions for `exp` (expiration), `iat` (issued at), and `nbf` (not before) claims.
Validate Signature (Optional)
Input your HMAC secret key (HS256) or public RSA/ECDSA key (RS256/ES256) to verify token authenticity.
Key Features & Capabilities
- RFC 7519 compliant JSON Web Token (JWT) decoder supporting HS256, HS384, HS512, RS256, and ES256 tokens
- Automatic Unix epoch timestamp conversion for `exp`, `iat`, `nbf`, and `auth_time` claims
- Live expiration status badge showing whether the token is Active, Expired, or Not Yet Valid
- 100% private client-side parsing ensuring sensitive Auth0, Firebase, and OAuth tokens are never transmitted across the network
Frequently Asked Questions
What are the three components of a JSON Web Token (JWT)?
A JWT consists of three Base64URL-encoded parts separated by periods (`.`): 1) **Header**: contains metadata including the signing algorithm (`alg`, e.g., HS256, RS256) and token type (`typ: "JWT"`); 2) **Payload**: contains application claims (user ID `sub`, permissions, roles, expiration `exp`); 3) **Signature**: cryptographic hash generated by signing the header and payload with a secret key or private key.
Can sensitive user data be safely stored in a JWT payload?
No. The payload of a standard JWT is **only Base64URL-encoded, not encrypted**. Anyone with access to the token can decode and view all payload claims (user IDs, emails, roles). Sensitive confidential data (passwords, credit card numbers, social security numbers) should never be placed in a standard JWT unless using JSON Web Encryption (JWE).
What is the difference between HS256 and RS256 signing algorithms?
**HS256 (HMAC with SHA-256)** is a symmetric algorithm using a single shared secret key for both signing and verifying the token. **RS256 (RSA Signature with SHA-256)** is an asymmetric algorithm where the authentication server signs the token using a private key, and microservices/clients verify it using a publicly distributed public key (JWKS).
What happens when a JWT expires (exp claim)?
When current Unix time surpasses the integer timestamp in the `exp` claim, standard OAuth/OIDC authentication middleware rejects the token with an `Unauthorized` (401) HTTP error, requiring the client application to obtain a new access token using a Refresh Token.
Related Utilities
Discover complementary online tools in the same workflow.
JWT Decoder
Decode JSON Web Tokens (JWT) to inspect header, payload claims, and expiration dates.
JSON Formatter & Validator
Format, beautify, minify, validate, and view JSON data online with instant syntax highlighting and error detection.
Base64 Encoder & Decoder
Encode text or binary data into Base64 format or decode Base64 back into raw string format.
CSV to JSON Converter
Easily convert CSV data to clean JSON format. Turn tabular spreadsheets into structured JSON.
YAML to JSON Converter
Convert YAML configuration files into structured JSON for APIs and modern web tooling.
Hash Generator (SHA-256, SHA-512, MD5)
Generate cryptographically secure SHA-256, SHA-512, SHA-384, and SHA-1 hashes for any text.