Token Interface
Paste a token, inspect the decoded header and payload, and review the claim timing summary without leaving the page or manually decoding Base64URL segments by hand.
Example token
Start with a sample JWT if you want to see the decoded header, payload, and claim timing flow before pasting a real token.
Encoded JWT
Paste the full token string here. The debugger will decode the header and payload as soon as the structure is valid.
Decoded header
Decoded header will appear here...
Decoded payload
Decoded payload will appear here...
How to Use This JWT Debugger
Use the debugger as a quick inspection workflow: paste the token, review the decoded output, and compare the claims against the auth behavior you are trying to verify.
Paste the encoded token
Add the full JWT string and let the page split the header and payload automatically.
Check the header first
Confirm the algorithm and token type before you move on to the claim data.
Review claims and timestamps
Inspect fields like sub, exp, iat, nbf, roles, audiences, and any custom claims your app depends on.
Use the decoded values to debug auth issues
Compare the token contents with your expected login flow, API guards, session timing, or permission checks.
When This Tool Is Most Useful
JWT inspection helps most when you are working through login flows, claim mismatches, token timing issues, or API authorization problems that are hard to understand from raw encoded strings alone.
Claim inspection during development
Read payload claims clearly when you need to understand what a login flow, identity provider, or auth middleware is actually returning.
Session and expiry debugging
Check exp, iat, and nbf fields when sessions look expired too early, tokens seem inactive, or auth timing feels off.
API permission troubleshooting
Verify roles, scopes, audiences, or custom claims when protected routes and backend checks are not behaving the way you expect.
Token structure verification
Confirm that the token header and payload match the algorithm, issuer, and format your frontend or backend is configured to handle.
How JWTs Work
A JSON Web Token is usually made of three Base64URL-encoded parts separated by dots: the header, the payload, and the signature. The first two parts are readable after decoding, while the last part is used for verification.
That structure is what makes JWTs convenient for APIs and auth flows. They are compact, easy to pass between services, and can carry enough claim data for a backend or frontend to make access decisions quickly.
Header
The header tells you how the token was signed and what type of token it is. This is where you usually see values like HS256, RS256, and typ: JWT.
Payload
The payload contains the claims. This is where user identifiers, roles, scopes, issuer data, and time-based fields like exp or iat usually live.
Signature
The signature is the final segment used to verify that the token has not been changed. A decoder can show it, but signature verification requires the right secret or public key.
How JWTs Are Secured
JWT security comes from signing and verification, not from hiding the header or payload. The decoded data is readable by design, but the signature helps your app detect whether the token was issued by the right system and whether it was changed later.
Signing protects integrity
A JWT is usually signed with a secret or private key so other systems can detect whether the token was changed after it was issued.
Verification depends on the right key
Backends verify the signature with the matching secret or public key. Without that key pair, a debugger can decode the token but cannot prove it is authentic.
Claims still need validation
Even with a valid signature, apps still need to check issuer, audience, expiry, not-before timing, scopes, and roles before trusting the token.
This debugger helps you inspect what is inside the token, but signature verification still needs the correct key material in the system that issued or accepts the JWT.
What This JWT Debugger Helps You Check
A debugger becomes useful once the token is readable. Instead of guessing what the auth system sent, you can check the parts that usually cause real problems.
Check whether the algorithm in the header matches what your app expects.
Review claim values like iss, aud, sub, roles, scopes, and custom authorization fields.
Inspect exp, iat, and nbf when session timing or token validity looks wrong.
Confirm that sensitive data is not being packed into the payload by mistake.
FAQs
Does this tool verify the JWT signature?
No. This page is for decoding and inspection only. It helps you read the header and payload, but it does not validate the token signature.Is JWT data sent to your servers?
No. Decoding happens locally in your browser so you can inspect tokens without uploading them anywhere else.What JWT fields are most useful to check first?
Start with the header algorithm, then look at exp, iat, nbf, iss, aud, sub, roles, scopes, and any custom claims your application depends on.When is a JWT debugger most helpful?
It is most useful when you are debugging login flows, session expiry, API authorization, role mapping, or claim mismatches between services.