Read a JWT header and payload

Developers use JWT reader to read parameters or token data before troubleshooting a request.

Read a JWT header and payload, so the values needed for debugging are easy to inspect. Use it for free in your browser, with no account required.

How to use

Copy the JWT you want to inspect, keeping all three dot-separated parts intact.
Paste it into the input area or import a text file containing the token.
Run the decoding action to display the header and payload in a readable form.
Look for diagnostic fields such as the indicated algorithm, expiration date, or user identifier.
Compare those values with what your application expects before diagnosing an authentication issue.

Example

The sample token contains a demo identifier, a role, and an issued-at value. After decoding, check that these fields appear in the payload and that the header describes the expected token type.

Limits and formats

Decoding does not verify the signature and cannot prove that a token is authentic.
An expired token can still be decoded; the page shows its content but does not decide whether it should be accepted.
The displayed data is readable by anyone who has the token, because a JWT is not encrypted.
The import control accepts several text formats, but the content must be a valid JWT string to produce a useful result.
Do not expose a real token in a shared screen or public chat, even though processing is local.

Where processing happens

The decoding work happens inside your browser. The token you paste or import stays on your device and is not transmitted anywhere else. You can inspect a test token quickly, but production tokens often carry sensitive claims and should still be handled with care.

Frequently asked questions

Does this tool validate the token?

No. It reads the header and payload, but it does not check the signature. Your application must perform that validation with the correct key or validation mechanism.

Can I decode an expired token?

Yes, the content remains readable after the expiration date. Decoding only shows the claims; it does not enforce expiration or any other security rule.

Why are some values missing?

First confirm that you pasted the complete JWT and that no part was cut off. If the token is valid, check the payload for the claim you need, since not every field belongs in the header.