This tool does not verify signatures

It decodes the header and payload so you can inspect claims. It never checks the signature against a secret or public key, so a decoded token is not proof that it's authentic or untampered.

JWT

Quick answers

Is it safe to paste a production JWT into this tool?
The decoding happens entirely in your browser and nothing is sent anywhere — you can confirm this in your browser's Network tab. That said, JWT payloads often contain user IDs, emails, or role claims, so treat any token like the sensitive data it usually carries and avoid pasting tokens tied to systems you don't control.
Why can't this tool tell me if a token is valid?
"Valid" for a JWT usually means signature verification succeeded against the issuer's secret or public key. That check requires the signing key, which should never be typed into a browser tool. This debugger only shows what the token claims about itself — header, payload, and the opaque signature segment — not whether those claims are trustworthy.

About JWT Decoder & Debugger

Free online JWT debugger and decoder. Inspect the JWT header, payload, and signature (Base64URL segments), read exp/iat/nbf claims, and see why signature verification needs your signing key server-side — this tool decodes only and never verifies signatures.

A JSON Web Token (JWT) is an industry-standard compact token format defined by RFC 7519. In the common JWS (JSON Web Signature) form used by most APIs, a token is three Base64URL-encoded segments joined by periods: the JWT header, the JWT payload (claims), and the JWT signature.

This JWT debugger splits the token on those periods, decodes the header and payload segments back to JSON, and shows the signature segment as-is — that's decoding, and it's all that happens here. Typical header fields include alg and typ; the payload often carries claims such as sub, iat, exp, and nbf.

Signature verification is a different operation: it means checking the JWT signature against a secret or public key to confirm the token wasn't tampered with and was issued by who it claims. This tool intentionally does not verify signatures, because doing it safely would require pasting a signing key into a web page — which you should never do here or elsewhere. If you need real JWT verification, do it server-side with a proper JWT library and your actual key.

The exp, iat, and nbf claims are Unix timestamps (seconds since epoch) per RFC 7519 NumericDate, so we convert them to both your local timezone and UTC. Tokens whose header advertises alg: "none" are flagged in red — that algorithm means no signature at all, and some libraries have historically mishandled trusting it.

Frequently asked questions

Is it safe to paste a production JWT into this tool?

The decoding happens entirely in your browser and nothing is sent anywhere — you can confirm this in your browser's Network tab. That said, JWT payloads often contain user IDs, emails, or role claims, so treat any token like the sensitive data it usually carries and avoid pasting tokens tied to systems you don't control.

Why can't this tool tell me if a token is valid?

"Valid" for a JWT usually means signature verification succeeded against the issuer's secret or public key. That check requires the signing key, which should never be typed into a browser tool. This debugger only shows what the token claims about itself — header, payload, and the opaque signature segment — not whether those claims are trustworthy.

What does an expired token look like here?

If the payload has an exp claim in the past relative to your device's clock, you'll see a red "Expired" badge next to the decoded output, along with the exact expiry time in both your local timezone and UTC.