JWT Debugger
Paste a JWT to read its header and payload, with the expiry decoded into something human. The token is parsed entirely in your browser — it is never sent anywhere, which is the whole point when the token in question is a live production credential.
Runs entirely in your browser. Nothing you paste is uploaded.
Header will appear here...
Payload will appear here...
Signature will appear here...
About the JWT Debugger
A JWT is three base64url segments separated by dots: header, payload, and signature. The first two are merely encoded, not encrypted, so anyone holding the token can read every claim inside it. Never put anything secret in a payload.
This tool deliberately does not verify signatures. Doing so would mean asking you to paste your signing key into a web page, and no debugging convenience is worth that. Verify signatures in your application or with a local CLI.
The standard claims worth knowing: exp (expiry), iat (issued at), nbf (not valid before), iss (issuer), aud (audience), and sub (subject). All timestamps are Unix seconds, not milliseconds.
Frequently asked questions
Is my token sent to a server?
No. Decoding happens in your browser with no network request at all. You can disconnect from the network and the tool still works.
Why can't this verify the signature?
Verification requires the signing key. Pasting a production signing key into any web page is a bad idea, so this tool decodes only. Verify in your application code or with a local CLI tool.
Can I trust the claims in a decoded token?
Only after verifying the signature. Anyone can craft a token with any claims they like; the signature is the only thing that makes them trustworthy.