JWT parser
Locally parse JWT, displaying the structure, Claims time status, and optional signature verification results using only the HS256 secret.
How to use the JWT parser
JWT and optional verification keys are parsed or verified only in the current browser; they are not uploaded or saved.
Paste test token
Prefer using a redacted or purpose-generated test JWT; do not paste production access tokens that are still valid.
Check statuses separately
A valid structure can be decoded, the Claims time status can be checked, and the signature can be verified; these are independent conclusions.
Provide verification materials
When needed, provide the HS256 secret and perform signature verification locally; other algorithms only have their structure parsed and are not verified on this page.
Limitations and Notes
- Being decodable does not mean the signature is valid, and a valid signature does not mean the issuer, audience, or business permissions are valid.
- The page will not query a remote JWKS, revocation lists, session status, or identity providers.
- Production authorization must be validated by the server according to the complete security policy and cannot rely on the results of this page.
FAQ
Why can the Payload be viewed while the status is still unverified?
The Header and Payload of JWT use reversible Base64URL encoding, so anyone can read them; verification requires a trusted key.
Does an unexpired exp mean that the token is usable?
Not necessarily. You still need to verify the signature, nbf, iss, aud, revocation status, and actual business permissions.