Decode and validate JWT tokens instantly. View header, payload, and verify signatures for JSON Web Tokens.
JSON Web Tokens are an open standard (RFC 7519) for securely transmitting information between parties as a JSON object.
Use this tool only with tokens you own or are authorized to inspect.
A JSON Web Token is a compact, URL-safe string built from three Base64URL-encoded segments joined by dots:
header.payload.signature.
The header declares the token type and signing algorithm (for example HS256 or RS256), the payload carries
claims such as subject, issuer, roles, and timestamps, and the signature is the cryptographic proof that
the other two segments were not altered in transit.
This debugger decodes the first two segments entirely in your browser and renders them as formatted JSON,
so you can inspect the algorithm and every claim without opening a terminal. It also converts the standard
time claims into readable dates, including
iat (issued at),
exp (expiration), and
nbf (not before), and reports
whether the token is currently Expired or Valid based on the expiration claim. The signature segment is
displayed but never verified, because verification requires the HMAC secret or public key that only the
issuing server should hold.
Treat every JWT as a bearer credential: anyone holding a live token can act as that user until it expires, so paste only test or expired tokens into any online debugger, including this one. Decoding here never leaves your machine, but the habit keeps you safe on less careful sites. To work with related encodings, try the Base64 Encoder/Decoder, validate decoded payloads in the JSON Formatter & Validator, or compare digests with the Hash Generator.
No. All decoding happens in your browser using built-in Base64URL decoding. The token, its header, and its payload are never transmitted to or stored on any server.
Verification requires the HMAC secret or the public key that only the issuing server controls. This tool is read-only: it displays the signature segment so you can compare it manually, but it never asks for secrets and cannot confirm authenticity.
iat (issued at) is when the token was created, nbf (not before) is the earliest time it should be accepted, and exp (expiration) is when it stops being valid. The debugger converts each Unix timestamp to a readable local date and marks the token Expired once the current time passes exp.
No. Editing a decoded payload would invalidate the signature, and any decent API server rejects tokens whose signature does not match. This debugger only reads what is already encoded.
It is not recommended. A JWT is a bearer credential, meaning possession equals permission until the token expires. Use throwaway or expired tokens for experimentation, and revoke any production token you have pasted into a tool you do not fully trust.