JWT Debugger & Decoder

A JWT debugger for secrets, payloads and expiry

A JSON Web Token looks like random text, but its first two parts are simply Base64URL-encoded JSON. This decoder splits a token into its header and payload and shows them as readable JSON. Time claims such as exp are converted into normal dates, and a badge shows how long the token has left, or how long ago it expired. That is often all you need to debug a 401 error.

Decoding takes place in your browser, so the token is not sent to any server.

The three parts of a token

A JWT has three sections separated by dots, in the form header.payload.signature.

• The header names the signing algorithm, such as HS256 or RS256, and the token type.
• The payload holds claims: facts about the user and the token's validity.
• The signature proves that the first two parts have not been changed since signing.

{ "alg": "HS256", "typ": "JWT" }

{
  "sub": "1234567890",
  "name": "Asha Rao",
  "iat": 1767225600,
  "exp": 1798761600
}

Common claims

• iss identifies the issuer, and aud the intended audience.
• sub is the subject, usually a user ID.
• iat, nbf and exp are the issue, not-before and expiry times, in seconds since 1970.
• jti is a unique token ID, which can be used to detect reuse.

How to verify a JWT secret key

Anyone can read a JWT, and anyone can write a new payload. Only the signature check tells you whether a token is genuine, so your server must verify it, along with the expiry and audience, before trusting any claim. Never accept a token that declares alg: none. This page warns you if it sees one.

To check an HS256, HS384 or HS512 token here, enter the shared secret under Verify signature. Tokens signed with RS256, ES256 and similar algorithms use a key pair, so verify those with the issuer's public key in your own code.

Because the payload is only encoded and not encrypted, do not place passwords, card numbers or other secrets in it.

Frequently Asked Questions

Do I need the secret to decode a JWT?

No. The header and payload can be read by anyone. The secret is only needed to verify the signature.

Why does my token fail with a 401 even though it looks valid?

Check exp first, then aud and iss. Also look for clock differences between servers, a wrong signing key, or a missing Bearer prefix in the Authorization header.

Is it safe to paste a production token here?

This page does not transmit it, but a live token gives access to whoever holds it. Prefer expired or test tokens where you can.

What do the numbers in exp and iat mean?

They are Unix timestamps in seconds, not milliseconds. The Standard claims table shows them as UTC dates.