JWT Debugger
Decode, inspect, and edit JSON Web Tokens. View the header, payload, and signature with syntax-highlighted JSON. Detect expired tokens instantly.
Features
Auto Decode
Paste a JWT and instantly see the decoded header, payload, and signature split into readable parts.
Syntax Highlighting
JSON is displayed with color-coded keys, strings, numbers, and booleans for easy reading.
Token Info Panel
See algorithm, issuer, audience, subject, issued-at, and expiration at a glance.
Expiration Warning
Expired tokens are highlighted in red with the exact expiration timestamp displayed.
Edit & Re-encode
Modify header or payload claims and apply changes to generate an updated encoded token.
100% Client-side
All decoding and encoding happens in your browser. No tokens are sent to any server.
About JSON Web Tokens
JSON Web Tokens (JWT) are an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. JWTs are commonly used for authentication and information exchange in modern web applications and APIs. A JWT consists of three parts: a header, a payload, and a signature, each Base64Url-encoded and separated by dots.
The header typically contains the signing algorithm and token type. The payload contains claims — statements about an entity (typically the user) and additional metadata. Standard claims include issuer (iss), subject (sub), audience (aud), expiration (exp), and issued-at (iat). The signature is created by signing the encoded header and payload with a secret or private key.
Our JWT Debugger lets you decode any token, inspect its claims with syntax-highlighted JSON, check for expiration, and even edit the header or payload to see how changes affect the encoding. Everything runs entirely in your browser — no tokens are ever sent to a server.
Frequently Asked Questions
What is a JWT?▼
A JSON Web Token (JWT) is a compact, URL-safe token format for representing claims between two parties. It consists of three Base64Url-encoded parts separated by dots: header.payload.signature. JWTs are widely used for authentication and data exchange in web APIs.
Can I verify the signature of a JWT with this tool?▼
This tool decodes and displays the JWT parts but does not verify the signature. Signature verification requires the secret key or public key used to sign the token. The tool focuses on inspection, debugging, and editing the token structure.
How do I know if my JWT is expired?▼
After pasting your token, the tool checks the 'exp' claim in the payload. If the expiration time has passed, a red warning banner appears showing the exact expiration date. Tokens without an 'exp' claim will not trigger an expiration warning.
Is it safe to paste my JWT tokens here?▼
All decoding happens entirely in your browser using JavaScript. No tokens are sent to any server. However, as a best practice, avoid pasting production secrets or sensitive tokens into any online tool.
What happens when I edit the header or payload?▼
When you modify the JSON in the editor and click 'Apply Edits', the tool re-encodes the modified JSON using Base64Url encoding and reconstructs the token. Note that the signature will no longer be valid since the content has changed.