Security Tool

JWT Debugger

Decode and inspect JSON Web Tokens. No data leaves your browser - everything is decoded client-side using standard base64 decoding.

Paste JWT Token

Or try the sample token to see how the debugger works.

All decoding runs entirely in your browser using standard base64 decoding. No tokens are ever sent to any server.

This tool decodes tokens for inspection. It does not verify signatures. Never trust a JWT without server-side verification.

Header contains the signing algorithm (e.g. HS256, RS256) and token type
Payload contains claims - statements about the user and metadata
Signature verifies the token was not tampered with (requires the secret key)
exp, iat, and nbf are standard time-based claims stored as Unix timestamps