JWT parser

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from JWT parser

JWT parser: Parse and decode your JSON Web Token (jwt) and display its content. JWT decoding reveals claims and algorithm metadata, which is useful for debugging expiration, audience, and application-specific fields. Parsing turns structured input into fields that are easier to inspect. It can reveal what a message or file says, but it does not automatically prove that the source is trustworthy or that an associated action succeeded. Preserve the original input while investigating and compare extracted values with the surrounding system’s expectations. Incomplete copies, altered line endings, and missing wrappers can prevent otherwise valid content from parsing. Start with a representative sample, inspect the fields most relevant to your question, and keep any validation result separate from the decoded content itself.

Guide updated October 13, 2026

How to use this tool

1. Paste the complete three-segment sample into JWT to decode, preserving both period separators and every character.
2. Inspect the decoded header and payload, including alg, sub, iss, aud, and the time-related claims. Interpret NumericDate values as seconds rather than milliseconds.
3. For this demonstration, open Signature validation, select the raw-text secret encoding, and enter example-secret. Keep the optional verification result separate from merely seeing readable claims.
4. Compare the claims with the intended application policy. A successful signature check does not itself establish the trusted issuer, accepted audience, or permitted action for a real application.

SEE IT IN PRACTICE

A worked example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vLXVzZXIiLCJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlIiwiYXVkIjoiZGVtby1hcGkiLCJleHAiOjE4OTM0NTYwMDB9.ETUgAozg1Zj-RPxm93hhuSEyC75O9URbKWdCH71AM0M

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "demo-user",
    "iss": "https://issuer.example",
    "aud": "demo-api",
    "exp": 1893456000
  }
}

This harmless demonstration token uses the public example secret example-secret. exp is 2030-01-01 00:00:00 UTC in Unix seconds. Decoding exposes these fields; it does not establish trusted signature verification or permission to use an application.

Read claims in their application context

The sub claim identifies a subject within the issuer’s context. The iss claim identifies the issuer, and aud identifies the intended audience. NumericDate claims such as exp, nbf, and iat use seconds relative to the Unix epoch, not milliseconds. An application must decide which claims are required and how they affect access. A claim being present does not make its value trustworthy.

Separate token shape from token acceptance

A common signed JWT has three Base64url segments separated by periods: header, payload, and signature. The first two segments are readable representations, not encryption. The verifier should use its configured algorithm policy and trusted key rather than blindly accepting the header’s alg value. A well-formed token can still be expired, intended for another audience, or signed by an untrusted key.

When this tool is useful

• Inspect token claims
• Debug an expiration value
• Review audience and issuer fields

Tips for a better result

• Readable claims are not proof of a valid signature or authorization; decoding and verification are different operations.
• A parsed value is a representation of supplied data; it does not by itself establish identity, authenticity, or successful delivery.
• Keep an original copy for troubleshooting because removing headers or reformatting a payload can change what the parser sees.

Frequently asked questions