JWT Payload Viewer
Decode JWT payload online free. View claims like sub, exp, iat in your browser. No upload, no account, no signature verification.
Runs locally in your browser. Your input is not uploaded to DevToolMate servers.
Not signature verification
Anyone can create a JWT with arbitrary claims. Decoding shows what is encoded, not what is true.
Developer Quick Tips
- Paste a JWT to view payload claims instantly. Decoding extracts the second segment; verification happens server-side only.
- Read exp and iat as Unix timestamps. Validate token freshness in your backend, never trust client-side claims alone.
- Anyone can create a JWT with arbitrary claims. Use this tool to inspect token structure during development and debugging.
- Extract payload claims locally without uploading. Your input stays on your device and clears when you close the tab.
- Payload viewer shows what is encoded, not what is true. Always verify signatures and issuer trust server-side.
Frequently asked questions
How do I decode a JWT payload online?
Paste your JWT into JWT Payload Viewer and it instantly decodes the payload segment in your browser. The tool extracts and displays the JSON claims without uploading your token to any server.
What JWT payload claims should I inspect?
Common registered claims include sub (subject), exp (expiration time), iat (issued at), aud (audience), and iss (issuer). JWT Payload Viewer displays these and any custom claims present in the payload JSON. Remember that decoding shows what is encoded, not what is verified as true.
What is the difference between JWT decode and JWT verify?
Decoding extracts and reads the claims from a JWT payload. Verification checks that the signature is valid and the token was issued by a trusted authority. JWT Payload Viewer only decodes; verification must happen server-side using your secret key or public certificate.
Does JWT Payload Viewer verify JWT signatures?
No. This tool only decodes and displays the payload. It does not verify signatures, validate issuer trust, or check token freshness. Decoding shows what is encoded, not what is true. Always verify signatures and validate tokens server-side.
Is it safe to paste production JWTs into this tool?
Yes, because JWT Payload Viewer runs entirely in your browser and never uploads your input to DevToolMate servers. However, avoid pasting tokens containing sensitive secrets or personally identifiable information. Redact values before sharing screenshots.
How do I read the exp and iat claims in a JWT?
After decoding, exp (expiration time) and iat (issued at) are shown as Unix timestamps in seconds. Use a Unix timestamp converter to translate them to human-readable dates, or check them programmatically in your application to enforce token freshness.
Can I use JWT Payload Viewer without an account?
Yes. JWT Payload Viewer is completely free and requires no login or account. Your input stays on your device for the current session and is cleared when you close the tab.
What is the at_hash claim in a JWT?
The at_hash claim is used in OpenID Connect and OAuth 2.0 flows to bind an access token to an ID token. It is a hash of the access token value. JWT Payload Viewer displays this claim if present in the payload, helping you verify token relationships during authentication debugging.
Related tools
- JWT Decoder: Decode JWT online and inspect bearer tokens locally in your browser. View header, payload, and OAuth 2.0 claims instantly. Free, no upload, no account.
- JWT Header Viewer: Decode JWT header online in your browser. View alg, typ, and other header fields locally. Free, no upload, no account required.