JWT Debugger
Decode, verify and debug JSON Web Tokens. Paste your token to view its header and payload instantly.
Encoded Token
Header
Algorithm & Token Type
{}Payload
Data & Claims
{}Signature
Verified Signature
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
your-256-bit-secret
)
Built With Care
“The decoder splits the token on its three dot-separated segments and decodes each base64url section with atob after converting the URL-safe - and _ characters to standard base64 + and / characters. It only decodes; signature verification is not performed, because JWT payloads are readable by anyone holding the token.”
JWT Debugger
Decode JSON Web Tokens instantly as you type, with the header, payload, and signature shown in three separate panels. Built for inspecting token structure — base64url handling, clear malformed-token errors, and a segmented layout that makes it obvious which part of a token is causing problems.
- 1Copy a JWT from your Authorization header, cookies, or localStorage.
- 2Paste it into the input field; decoding happens automatically.
- 3Read the header section for the signing algorithm and token type.
- 4Read the payload for claims such as exp, iat, sub, and the issuer.
- 5Note that the signature is displayed but not verified by this tool.
- 6Use the Paste button to import a token from the clipboard with one click.
- Automatic Decoding: No submit button; results update as you type or paste.
- Segmented Display: Header, payload, and signature shown in separate panels.
- Base64url Handling: Converts JWT-safe characters correctly before decoding.
- Clear Error Reporting: Messages identify missing segments or malformed base64.
- Clipboard Import: One-click paste from the system clipboard.
- Local Processing: Tokens are decoded entirely in your browser.
JWT Debugger Specs
Limits
- Decodes JWT without validation by default
- Signature verification available with secret
Formats
- Output: header, payload, signature decoded
Defaults
- Auto-detect token from clipboard
- Payload pretty-printed
How it works
- Base64url decode + HMAC verify (WebCrypto)
Honest caveats
- Never paste production tokens
- Algorithm confusion only if you verify
Real Ways People Use This
Debugging Auth Flows
Paste a token from your browser DevTools to verify which claims your backend expects and whether it has expired.
Learning JWT Structure
See exactly how header, payload, and signature sections are encoded and separated by dots.
Inspecting Third-Party Tokens
Examine claims embedded by OAuth providers or APIs without needing their signing secret.
Support Triage
Quickly determine whether a reported token is malformed or merely expired before escalating to engineering.
Security Review
Check for unexpected claims or dangerous algorithm values such as none in incoming tokens.
- This tool decodes but does not verify signatures; anyone can craft a JWT with a valid structure.
- Expired tokens still decode, so check the exp claim manually against the current time.
- Malformed or non-standard base64url tokens fail to decode and show an error message.
- 1Confirm the token has exactly three dot-separated parts before pasting.
- 2Compare the exp claim against the current time to check validity.
- 3Review the alg claim and reject tokens that say none in production.