JWT Debugger

Decode and inspect JSON Web Tokens (JWT) to view their header, payload, and signature.

About this tool

A JSON Web Token (JWT) is a compact, signed token used for authentication and authorization — it's three Base64URL-encoded, dot-separated segments (header, payload, signature) that together carry claims about a user or session.

How to use it

1. Paste a JWT into the input box.
2. The header and payload are decoded and displayed immediately as readable JSON.
3. Review the claims (like sub, exp, and iat) in the payload.

FAQ

Can this tool verify the token's signature?

No — it decodes and displays the header and payload only. Verifying the signature requires the secret or public key the token was signed with, which this tool never asks for or handles.

Is decoding a JWT the same as it being valid?

No. Decoding just reads the Base64URL-encoded claims — it doesn't confirm the token hasn't been tampered with or that it hasn't expired. Only signature verification (server-side, with the correct key) confirms a token is genuine.

Is it safe to paste a real production JWT here?

The token is decoded entirely client-side and never sent anywhere, but as a general rule, avoid pasting real tokens with active sessions into any third-party tool if you can use a test token instead.