JWT Debugger & Decoder
Paste a JSON Web Token to decode its header and payload, with exp/nbf/iat timestamps converted to readable UTC and relative time. Everything happens in your browser: the token is never sent to a server, and its signature is never verified, since that would need the issuer's secret or public key.
Last updated: September 9, 2026
How to use this tool
- Paste a full JWT (three base64url parts separated by dots) into the box above.
- Click Decode to see the header, payload, and any expiry/issued-at timestamps converted to readable time.
- Use it to debug why an API call is being rejected, or to confirm a token actually carries the claims your application expects.
A JWT is three dot-separated base64url segments, for example: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U — the first two decode to plain JSON here; the third, the signature, can only be verified with the issuer's key.
What this tool does not do
It does not verify the signature. Doing that correctly requires the same secret (for HMAC algorithms like HS256) or the issuer's public key (for RSA/ECDSA algorithms like RS256/ES256) that was used to sign the token, neither of which this tool asks for or needs, since decoding the header and payload only requires reversing base64url, no cryptography involved. A token can decode perfectly here and still have an invalid or forged signature.