JWT Debugger

Decode and inspect JSON Web Tokens (JWT) instantly.

Encoded Token

Decoded

HEADER: Algorithm & Token Type
// Header will appear here
PAYLOAD: Data
// Payload will appear here

What is this Tool?

JWT Debugger is an essential tool for web developers working with authentication. It decodes JSON Web Tokens (JWT) instantly, revealing the hidden data structure without needing a backend server or secret key (for decoding).

A JWT consists of three parts separated by dots: the Header (algorithm info), the Payload (user claims like ID, role, expiration), and theSignature (integrity check). This tool parses these components so you can inspect them clearly.

How to use

  1. Paste Token: Copy your encoded JWT string (usually starting with `eyJ...`) into the input box.
  2. Inspect: The tool automatically splits and decodes the token. View the Header to see the signing algorithm (e.g., HS256, RS256).
  3. Check Claims: Look at the Payload section to verify user details, permissions (`scope`), and expiration (`exp`) timestamps.
  4. Validate Format: If the token is malformed or corrupted, an error message will appear immediately to help you debug.

Why do you need it?

  • Debugging Auth Issues: standard "401 Unauthorized" errors are vague. Use this tool to check if the token is expired (`exp` claim) or has the wrong role.
  • Security Audits: Ensure your tokens aren't leaking sensitive PII (Personally Identifiable Information) in the payload, which is readable by anyone who intercepts the token.
  • Frontend Development: Quickly mock or verify tokens during development without waiting for backend logs.

FAQ

Q. Is it safe to paste real tokens?

Yes. This tool runs entirely in your browser (client-side). Your tokens are NOT sent to any external server, so your secrets remain safe.

Q. Can I verify the signature here?

Currently, we only decode the payload for inspection. Full signature verification (requiring you to input your secret key) is planned for a future update.

Q. What is the 'exp' field?

It stands for Expiration Time. It's a Unix timestamp indicating when the token becomes invalid. We verify this automatically in many auth flows.