JWT Debugger
The JWT Debugger decodes a JSON Web Token into its header, payload and signature parts so you can inspect claims, expiry and algorithm. It helps you debug auth flows without sending tokens to a server.
Key Features
- Split a JWT into header, payload, signature
- Read standard claims like sub, exp, iat
- Show human-readable expiry time
- Verify signature with your secret or public key
- Highlight expired tokens
- Client-side, tokens never leave the browser
Use Cases
- Inspect a token returned by your login API
- Check why a request is rejected as unauthorized
- Debug expiry and clock-skew issues
- Teach how JWT structure works
How to Use
- Paste the JWT string
- Read the decoded header and payload
- Check exp and other claims
- Optionally paste a secret or key to verify the signature
- Note whether the token is expired
Practical Tips
- Never paste production secrets into untrusted tools; this one runs locally
- exp is in seconds since epoch; compare with current time
- alg none and weak HS256 are common pitfalls to watch
FAQ
- Is it safe to paste a token here?
- The tool runs in your browser and does not upload the token, but avoid pasting secrets you do not control.
- Does it verify the signature?
- Yes, if you provide the correct secret or public key; otherwise it only decodes.