JWT Reader
Decode and inspect JWT tokens
About JWT Reader
Decodes a JSON Web Token as you paste it, showing the header and payload as formatted JSON and the signature as raw Base64URL. If the payload has an exp claim, a badge tells you whether the token has expired and shows the expiry in your local time. Tokens signed with any algorithm, such as HS256 or RS256, can be decoded, but signatures are never verified.
Category: API.
Frequently asked questions
What is a JWT?
▾
A JSON Web Token (JWT) is a compact, URL-safe string for transmitting claims between parties. It's composed of three Base64URL-encoded parts separated by dots: header, payload, and signature.
Does it verify the token's signature?
▾
No. It only decodes, and the Valid or Expired badge simply compares the exp claim with your device's clock. Verification needs a key (the shared secret for HS256, or the public key for RS256 and ES256), so check signatures on your server or with a JWT library before trusting any claim.
Why does it say "Invalid JWT token"?
▾
The input must have exactly three dot-separated parts, and the first two must be Base64URL-encoded JSON. Paste the token without the Bearer prefix or surrounding quotes; encrypted JWE tokens, which have five parts, can't be decoded.
Is it safe to paste my JWT here?
▾
Decoding happens entirely in your browser, and the token is never sent to a server or saved. Still, a JWT works like a password until it expires, so prefer test or expired tokens over live production ones.