JWT Debugger
Decode and inspect JSON Web Tokens: view the header and payload, check expiry, and verify HS/RS/PS/ES signatures — all in your browser.
Prefer the terminal? See the CLI equivalent →About the JWT Debugger
- Decode header & payload
- Verify the signature
- Shareable link (token only)
- Instant results
- 100% private — runs in your browser
- Free, no sign-up
A JSON Web Token (JWT) is a compact, URL-safe way to transmit signed claims between two parties — most commonly to prove that a user has authenticated. A JWT has three Base64URL-encoded parts joined by dots: a header describing the signing algorithm, a payload carrying the claims, and a signature. Because the header and payload are only encoded — not encrypted — anyone holding a token can read its contents.
This debugger decodes the header and payload entirely in your browser, lays out the registered claims with human-readable timestamps, flags whether the token is expired or not yet valid, and verifies the signature for HMAC (HS256/384/512), RSA (RS and PS), and ECDSA (ES) algorithms. Your token and any secret or key you paste never leave your device — there is no server to send them to.
Decoding a token is not the same as trusting it. A decoded payload only tells you what the token claims; you must verify the signature against the issuer’s secret or public key before you rely on any of it. This tool makes both steps explicit so you can debug authentication issues with confidence.
How to use it
- Paste a JWT into the token editor, or load one with the ⬆ upload button. The header and payload are decoded and pretty-printed immediately, and each can be copied from its toolbar.
- Review the claims table — issued-at, expiry, and not-before are shown as readable dates alongside the raw epoch values, with a badge indicating whether the token is currently valid.
- To verify the signature, select the algorithm family and paste the shared secret (for HS*) or the public key / certificate (for RS, PS, ES). The tool reports whether the signature is authentic.
- Edit the token in place to see how changes affect decoding and validity — useful for understanding a token structure without writing code.
- Use “Query with JSONPath →” above the payload to open it in the JSONPath Tester and drill into the claims.
Standard registered claims
The JWT specification (RFC 7519) defines a set of reserved claim names with agreed meanings:
- iss
- Issuer — who created and signed the token.
- sub
- Subject — the principal the token is about (often a user ID).
- aud
- Audience — the recipient(s) the token is intended for.
- exp
- Expiration time — a Unix timestamp after which the token must be rejected.
- nbf
- Not before — a Unix timestamp before which the token is not yet valid.
- iat
- Issued at — when the token was created.
- jti
- JWT ID — a unique identifier used to prevent replay.
Frequently asked questions
Is it safe to paste a JWT here?+
Yes. All decoding and signature verification happen locally in your browser using the Web Crypto API. Your token, secret, and keys are never transmitted to or stored on any server. That said, avoid pasting production tokens into any online tool you do not control; this one is safe because it is fully client-side, but the habit is worth keeping.
Can this tool decrypt an encrypted JWT (JWE)?+
No. This tool works with signed tokens (JWS), which are the common case for authentication. JSON Web Encryption (JWE) tokens have five parts instead of three and require the recipient’s private key to decrypt; they are not supported here.
Why does my token show as expired?+
The exp claim is a Unix timestamp, and the token is considered expired once the current time passes it. Check the decoded expiry date in the claims table. Clock skew between the issuer and your machine can also cause a token to appear expired or not-yet-valid by a few seconds.
What is the difference between decoding and verifying?+
Decoding simply Base64URL-decodes the header and payload so you can read them — it proves nothing about authenticity. Verifying recomputes the signature using the secret or public key and checks it against the signature in the token, which is what proves the token was issued by the expected party and has not been tampered with.
Which signing algorithms are supported?+
HMAC with SHA-256/384/512 (HS256, HS384, HS512), RSA (RS256/384/512 and the PSS variants PS256/384/512), and ECDSA (ES256, ES384, ES512).
Works well with
JWT Debugger chains with these tools — send your result straight on:
Related tools
ASN.1 Decoder
Decode ASN.1 DER/BER — paste PEM, Base64, or hex and see the tag–length–value tree behind X.509 certificates, keys, and CMS, entirely in your browser.
Certificate Decoder
Decode X.509 / PEM certificates — view subject, issuer, validity, SANs, key, and fingerprints, all in your browser.
Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text or a file, plus HMAC — all at once, entirely in your browser.
JWT Signer
Build a JWT header and payload and sign it with HMAC (HS256/384/512) or an RSA/ECDSA private key (RS/PS/ES) — entirely in your browser. Nothing is uploaded.
Metadata Inspector
Inspect the hidden metadata in a photo or document — EXIF, GPS location, author, dates, and more — right in your browser. Download a cleaned copy with the metadata removed.
Metadata Stripper
Strip EXIF, GPS, author, and hidden metadata from images and documents in one batch — locally in your browser. JPEG, PNG, WebP, GIF, PDF, Office, OpenDocument & EPUB.