JWT Decoder & Debugger
Decode and debug JSON Web Tokens (JWT) 100% client-side. Inspect header algorithms, payload claims.
Encoded JWT Token String
Decoded Claims & Status
⚖️ Decision Verdict: Valid Unexpired Token
The token exhibits standard three-part RFC 7519 structure with a signed payload. The expiration timestamp (`exp`) is set in the future.
Formatted JSON Payload & Header
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"admin": true,
"iat": 1516239022,
"exp": 2080000000
}About this tool
How to use it
- Paste your encoded JSON Web Token (JWT) into the input box.
- Inspect the decoded JSON header and payload claims instantly.
- Check the real-time expiration badge (ACTIVE vs EXPIRED) and UTC date translation.
- Verify standard identity claims like `sub`, `iss`, `aud`, and `iat`.
- Click 'Copy Header' or 'Copy Payload' to export clean formatted JSON.
Why it matters
JSON Web Tokens (JWT) are the standard mechanism for API authentication and OAuth 2.0 / OpenID Connect authorization. However, because tokens are encoded in Base64URL rather than encrypted, inspecting what data a token contains (and verifying why an API returns 401 Unauthorized due to an expired timestamp) is a daily engineering requirement. Running the decoder 100% client-side ensures sensitive credentials and user claims are never exposed over the network.
When to use it
Use this debugger when troubleshooting API authentication errors, validating OAuth token lifetimes, debugging microservice identity headers, or reviewing claims passed between web apps.
Good to know
Privacy & Security Guarantee: This tool runs exclusively client-side in your browser. Tokens, payload claims, and headers are never transmitted over the internet or logged.
Common questions
What are the three parts of a JWT?
A JSON Web Token consists of three base64url-encoded parts separated by periods: Header (algorithm and token type), Payload (claims and user data), and Signature (cryptographic verification hash).
Is a JWT encrypted?
No! A standard JWT is signed, not encrypted. Anyone with access to the token string can read the header and payload claims by decoding the Base64URL encoding. Sensitive secrets should never be stored unencrypted in JWT payloads.
What does the `exp` claim mean?
The `exp` (expiration time) claim identifies the exact expiration timestamp (in seconds since the Unix epoch, Jan 1 1970 UTC) after which the token must not be accepted for processing.
Why is client-side decoding safer?
Many online JWT tools send your tokens across the internet to their servers. If the token contains bearer credentials or internal employee email addresses, this creates a data leak. Client-side decoding guarantees your data never leaves your device.
What is the difference between HS256 and RS256?
HS256 is a symmetric algorithm using a shared secret key for both signing and verification. RS256 is an asymmetric algorithm that signs with a private RSA key and verifies with a public key.