JWT Debugger
Paste a JSON Web Token to decode its header and payload in your browser, check the expiry date, see which algorithm it uses, and copy the claims as JSON. Nothing is uploaded — your token never leaves this page.
Paste your token
Token summary
Header
Payload (claims)
Signature
Encoded signature part:
The signature cannot be verified by this page, because verification needs the secret key or public key. If the token says alg is none, anyone can forge it — the warning above marks that case.
How to use
- Paste a JWT into the text box above (it looks like three blocks of text joined by dots).
- Press Decode Token to see the header, the payload claims, the expiry date, and the algorithm.
- Use the copy buttons to copy the header or payload JSON for your notes or API tests.
- Try the sample token first if you just want to see how a decoded token looks.
Frequently asked questions
It splits the token into its three parts — header, payload, and signature — and shows the header and payload as readable JSON, plus a summary table with the algorithm, expiry date, and issued-at date.
No. Decoding happens fully in your browser with JavaScript. Your token is never uploaded or shared with any server, so real production tokens are safe to inspect here.
A token with the none algorithm is not signed at all, so anyone can create or change one and your server may accept it. This tool shows a warning whenever it sees alg none. Never use unsigned tokens in production.
The summary table reads the exp claim and shows it as a human date and time, with a green "valid" badge if it is still in the future and a red "expired" badge if it has passed. Tokens without an exp claim are labelled "no expiry set".
No. Verifying a signature needs the secret key or the public key, which you should never paste into a browser tool. This debugger only decodes and inspects — treat its output as information, not proof the token is genuine.