Decode and inspect JSON Web Tokens — header, payload, claims, and expiry. No validation — browser only.
—
—
JWT Debugger decodes JSON Web Tokens directly in your browser, showing the header, payload, and signature in a readable format. It checks the token structure and expiration claims without sending the token to any server — essential when debugging authentication issues in development.
A JSON Web Token consists of three Base64URL-encoded segments separated by dots: a header (algorithm and token type), a payload (claims like sub, exp, iat, and custom fields), and a signature for verification. This compact format makes JWTs ideal for stateless authentication in REST APIs and single-page applications.
When authentication breaks — a 401 response, a redirect loop, or a claim that seems wrong — the first debugging step is to decode the JWT and inspect its contents. Is the exp claim in the past? Is the audience correct? Does the subject match the user ID you expect? This tool answers those questions in seconds.
This tool runs entirely in your browser and makes no network requests, making it safe for debugging tokens that contain sensitive claims during development.
Paste a JWT from an Authorization header
Result: Header decoded: {alg: 'RS256', typ: 'JWT'} — confirms the signing algorithm used
Check exp claim: 1703980800
Result: Decoded as: 2024-12-31 00:00:00 UTC — compare to current time to confirm token validity
Inspect custom claims
Result: Payload may include role, org, permissions — verify your authorization logic matches the token content
Can this tool verify the JWT signature?
To verify a signature you need the secret (for HMAC like HS256) or public key (for RSA/EC like RS256). Paste it into the Verify section. Without it, the tool can only decode — not verify — the token.
Is it safe to paste my JWT here?
Yes — this tool runs entirely client-side with no network requests. Your token never leaves your browser. Be cautious with production tokens containing real user data.
What does invalid signature mean?
The signature does not match when computed with the provided secret/key. Common causes: wrong secret, tampered token, or algorithm mismatch.
What is the difference between HS256 and RS256?
HS256 uses a shared secret (symmetric) — both issuer and verifier must know it. RS256 uses a key pair (asymmetric) — the issuer signs with the private key; anyone with the public key can verify. RS256 is preferred for distributed systems.
Why is my token very long?
JWT length scales with payload size. Each claim adds roughly 1.33x its plaintext size due to Base64URL encoding. Large tokens can exceed cookie size limits (4KB) or HTTP header limits — keep payloads lean.