View JWT token contents
Paste a JWT to read header and payload — expiry, user fields, audience, and whatever else was encoded. This tool does not verify signatures, so it cannot prove the token is genuine or untampered. Use only for development debugging; do not treat decoded claims as trusted facts.
View only — authenticity is NOT checked. Never paste important secrets into sites you do not trust.
JWTs are three Base64URL chunks: header, payload, signature. Anyone can decode the first two; tamper protection requires verifying the signature with the secret or public key on the server.
Seeing `exp`, `sub`, or `roles` only tells you what the token claims — not what your API will honor after proper validation.
Tokens from user browsers may contain PII. Redact before screenshots or sharing.
How to inspect
- Paste the JWT string
- Read header and payload JSON
- Optional: convert `exp` with the timestamp tool
- Never use this page alone for security decisions
What you can see here
- Header and payload fields at a glance.
- Check claims like `exp` when debugging 401s.
- No signature check — useful for inspection, not proof the token is valid.
Scenarios
- 401 on an API — is `exp` in the past?
- Wrong environment — check `aud` / `iss`
- Teaching JWT structure in a workshop
Safety notes
- Do not paste long-lived production signing secrets here.
- Redact personal identifiers in screenshots.
- Pair with Timestamp Converter to read `exp` as a clock time.
What you will see
| Input | Output | Note |
|---|---|---|
| Three-part JWT | header JSON + payload JSON | Signature shown, not verified |
| `exp` claim | Compare on timestamp page | Expired or still valid? |
JWT FAQ
- If it decodes, is the token valid?
- No. Without signature verification, contents are unauthenticated claims only.
- What if the signature is wrong?
- This page may still show header/payload. Only your server’s verify step decides acceptance.
- Encrypted JWT (JWE)?
- Encrypted tokens need keys to decrypt — not supported here.