JWT Decoder and Debugger

A JWT decoder that stays in your browser

A JWT (JSON Web Token) is the token many APIs and apps pass around after you sign in. This JWT decoder shows the header and payload as colour-coded JSON, turns timestamps into dates, explains each standard claim and, if you supply the secret or public key, checks the signature. Think of it as a JWT debugger for the moment an API answers 401 and you need to know why.

Decoding, verification and token creation all run in your browser: no token is sent anywhere and nothing is stored. Even so, never paste a live production token into a site you do not know. Whoever reads it can use it until it expires.

How to decode a JWT

1. Paste the token into “JWT token”. A leading “Bearer” copied from an HTTP header is stripped automatically. “Load an example” fills in a demo token.
2. The three parts appear in colour, followed by the “Header”, “Payload” and “Signature” panels. Hover over an underlined key such as exp or iss to see what it means.
3. “Dates and validity” converts iat, nbf and exp into readable dates and gives the status, for example “Expired 3 days ago” or “Still valid for 45 minutes”.
4. Under “Verify the signature”, enter the shared secret for HS256, HS384 or HS512, or paste a PEM or JWK public key for RS256, PS256 or ES256. You get “Signature valid” or “Signature invalid”.
5. “Create an HS256 test token” builds a token from a header, a payload and a secret of your choice.

Inside a JSON Web Token

A signed JWT has three parts separated by dots: header.payload.signature. The header eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 decodes to {"alg": "HS256", "typ": "JWT"} and names the signing algorithm. The payload holds the data, called claims. In the tool's example it is {"sub": "42", "name": "Example", "iat": 1700000000, "exp": 4102444800}: the token was issued on 14 November 2023 at 22:13:20 UTC and expires on 1 January 2100 at 00:00 UTC. The signature seals the first two parts.

Base64url is not encryption

The header and payload are only encoded in base64url, a Base64 variant that swaps + and / for - and _ and drops the = padding. Anyone can read the payload without any key. The signature stops people from changing it, not from reading it. A token with five parts is a JWE, an encrypted form that the tool recognises but cannot open.

Standard claims

The specification defines seven short names: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at) and jti (unique token ID). Dates are Unix timestamps in seconds.

Symmetric and asymmetric signatures

HS256 uses one shared secret both to sign and to verify, with HMAC-SHA-256, and produces a 32-byte signature. RS256 and ES256 use a key pair: the server signs with its private key and any service can verify with the public key, often published as a JWK set. An RS256 signature with a 2048-bit key is 256 bytes; an ES256 signature is 64 bytes. If the header says alg “none”, the token is not signed at all, and the tool shows a warning because a server must never accept it.

Good practice

• Keep access tokens short-lived, from a few minutes to an hour.
• Never put passwords, secrets or sensitive personal data in the payload: anyone can read it.
• Always verify the signature, the expected algorithm, exp and aud on the server. Decoding in a browser helps you understand a token; it is not a reason to trust it.

Frequently asked questions

Can I decode a JWT without the key?

Yes. The header and payload can be read without any key. The secret or public key is only needed to verify the signature.

Why is the signature invalid when the secret is right?

Your server may store the secret in base64: tick “The secret is base64url-encoded”. Also look for stray spaces, and check that the algorithm in the header is the one your server uses.

Is my token stored?

No. The token, secret and key stay in the page, with no upload and no storage. They are gone as soon as you close or reload the tab.