Tools/Dev/JWT Decoder & Debugger

JWT Decoder & Debugger

What is a JSON Web Token (JWT)?

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

Why Use Our JWT Debugger?

JWTs often contain sensitive user information or authentication credentials. Unlike many online tools that send your token to a server, our tool parses, decodes, and verifies the JWT entirely within your browser using client-side JavaScript. Your token never leaves your device.

What this tool does

Header & payload decoding: Instantly view the algorithm, token type, and all claims
Expiry check: Shows whether the token is expired and how much time remains
Signature verification: Confirm an HS256 token hasn't been tampered with, given its secret

How to Use

Paste Token: Paste your raw JWT string into the input area.
Inspect Payload: Instantly view the decoded header (algorithm type) and payload (claims and data).
Check Expiry: The tool automatically calculates and displays whether the token is expired or how long it is valid for.
Verify Signature: Enter your secret key (for HS256 tokens) to verify that the token has not been tampered with.

Glossary

Header: The first part of a JWT, which typically consists of two parts: the type of the token (JWT) and the signing algorithm being used, such as HMAC SHA256 or RSA.
Payload: The second part of a JWT containing the claims. Claims are statements about an entity (typically, the user) and additional data.
Signature: The third part of a JWT, created by taking the encoded header, the encoded payload, a secret, and the algorithm specified in the header.
Claim: A piece of information asserted about a subject in a JWT payload, such as the user ID (sub), expiry (exp), or issuer (iss).
HS256 vs. RS256: HS256 signs and verifies with the same shared secret; RS256 uses a public/private key pair, so verification only requires the public key.

Frequently Asked Questions about JWT Decoder & Debugger

No, this tool decodes and verifies your JWT entirely within your browser using client-side JavaScript. Your tokens never leave your device, ensuring maximum security for sensitive credentials.

For HS256 tokens, we use native cryptographic libraries in your browser to calculate the HMAC-SHA256 hash of the header and payload using the secret you provide, and then compare it to the signature attached to the token.

If you don't provide a secret, the tool can still decode the header and payload so you can inspect the contents and check the expiry date. However, it won't be able to verify if the token has been tampered with.

Decoding the header and payload works the same regardless of algorithm. Signature verification for RS256 requires the public key rather than a shared secret — check which algorithm your token's header specifies before attempting verification.

Some systems tolerate a short clock-skew window or don't strictly enforce the exp claim. This tool reports the exp claim's literal expiry — if your app behaves differently, that's a difference in how your server validates tokens, not an error in the decoding here.

Related Tools

Explore more tools from this category to enhance your workflow

Mock Data Generator

Generate realistic fake data instantly. Export as JSON, CSV, YAML, TOML, or TOON completely offline.

JSON Formatter & Validator

Format, validate, minify, and beautify your JSON data securely in your browser.

JSON to CSV Converter

Convert JSON arrays and objects to CSV format. Supports nested object flattening.

Timestamp / Epoch Converter

Convert Unix timestamps to readable dates, and readable dates to Unix timestamps instantly.