Web

JWT Parser

Decode a three-segment JWT to inspect its JSON header, payload and declared timestamps locally. Understand malformed tokens and why decoding is not verification.

Local processing

Loading tool workspace...

About this tool

When to use it

Decode a three-segment JWT to inspect its JSON header, payload and declared timestamps locally. Understand malformed tokens and why decoding is not verification.

How to use it

For authentication debugging, use a synthetic token or a token from an authorized test environment. Paste the compact token without the Bearer prefix, then select Decode JWT. Inspect the header and payload and compare declared times with the issuing system. Clear removes the input and decoded details. There are no dedicated copy or download controls; manual text selection is available.

Guide updated 2026-09-11. Examples checked against this implementation.

Worked examples

Inspect a deliberately unsigned fixture

Input

eyJhbGciOiJub25lIn0.eyJzdWIiOiJkZW1vIn0.

Expected output

Header: {"alg":"none"}
Payload: {"sub":"demo"}
Signature segment: (empty)
Issued at: Not declared
Expires at: Not declared
Expired: Unknown

The final dot is required for the empty third segment. This fixture demonstrates readable claims only. It is not an authentication credential and must not be accepted by a production verifier.

Errors and unsupported input

eyJhbGciOiJub25lIn0.eyJzdWIiOiJkZW1vIn0

Only two segments are present. Copy the entire original token including both dots. Do not invent a missing signature for a real token.

invalid.e30.

The first segment is not a decodable JSON header. Obtain the original token, remove any Bearer prefix and check for truncation or copied quotation marks.

Continue this workflow

JSON Formatter & Validator: Inspect or format a copied JSON payload while remembering its claims remain unverified.
Timestamp Converter: Convert a numeric time claim using Unix seconds to compare it with application logs.

Format references

JWT claims and validation (RFC 7519)

Format rules and limitations

JWT input is limited to 1 MiB (1,048,576 UTF-8 bytes). The decoder handles three compact segments, not five-segment encrypted JWE tokens.

Header and payload decoding is not full JWT validation. The signature segment is only displayed, without cryptographic verification or key lookup.

Numeric iat and exp values are interpreted as seconds since the Unix epoch. Expired uses the device clock. A missing expiry shows Unknown; a future expiry does not establish token validity.

A trusted verifier must enforce the expected algorithm, signature, issuer, audience and applicable time constraints. Never treat displayed claims as established identity or authorization.

Privacy and security

These tools process input in browser memory without an upload or processing API. DevMate does not save these inputs in localStorage, sessionStorage, or a share URL. Reloading starts a new workspace; browser history restoration may retain form state. Copy writes to your system clipboard and Download saves a file, which can outlive the tab. The page still loads site assets and may contact configured analytics, consent, or advertising services. DevMate analytics records route and action names, without input, output, filenames, or raw errors.

Review sensitive or production-critical output in the trusted system where it will be used.

Questions

Frequently asked questions

Does Expired: No mean I can trust the token?

No. It only compares the declared expiry to this device clock. The token may have a forged signature, wrong issuer or audience, or other invalid claims.