JWT Debugger & Decoder
Paste a JSON Web Token to decode its header and payload, with exp/nbf/iat timestamps converted to readable UTC and relative time. Everything happens in your browser: the token is never sent to a server, and its signature is never verified, since that would need the issuer's secret or public key.
Last updated: August 30, 2026
What this tool does not do
It does not verify the signature. Doing that correctly requires the same secret (for HMAC algorithms like HS256) or the issuer's public key (for RSA/ECDSA algorithms like RS256/ES256) that was used to sign the token, neither of which this tool asks for or needs, since decoding the header and payload only requires reversing base64url, no cryptography involved. A token can decode perfectly here and still have an invalid or forged signature.