JWT debugger
Your result will appear here.
About JWT debugger
JWT Debugger decodes any JWT token and displays the header and payload as formatted JSON. Use it to inspect token claims, check expiry, and verify algorithm during development — without sending tokens to a third-party server.
When to use JWT debugger
- Inspect claims (sub, iat, exp, roles) inside a token during API development
- Verify an authentication token contains the expected user ID and permissions
- Check the exp claim to understand why a token is being rejected as expired
- Confirm the signing algorithm (alg) matches your security requirements
- Decode tokens from OAuth, Auth0, Cognito, Firebase, or any JWT-based auth system
How it works
A JWT is three Base64URL-encoded segments separated by dots: header.payload.signature. The tool splits on dots, normalizes URL-safe characters (replacing - with + and _ with /), adds RFC 4648 padding, then uses atob() to decode each segment and JSON.parse() to format the result. The signature is shown as Present or Missing but is not cryptographically verified.
Example
Decoded JWT
Input:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6Ik5hZGhlYmUiLCJpYXQiOjE3MTYyMzkwMjJ9.signatureOutput:
Header
{
"alg": "HS256",
"typ": "JWT"
}
Payload
{
"sub": "1234",
"name": "Nadhebe",
"iat": 1716239022
}
Signature
PresentPrivacy & security
JWT debugger runs entirely in your browser. No input data is uploaded to any server, stored in a database, or shared with third parties. You can use it offline once the page has loaded.
Frequently Asked Questions
Common questions about this tool.
Is it safe to paste my JWT tokens here? ▼
JWT Debugger runs 100% in your browser — your token is never transmitted to any server. As a general security practice, avoid using production tokens with sensitive payloads in any browser tool. Use test tokens for debugging when possible.
Does this tool validate the JWT signature? ▼
No. Signature validation requires the secret key or public key and is intentionally not performed here. This tool reads token contents — not a security validator. Use your authentication library for signature verification.
What do "iat" and "exp" claims mean? ▼
"iat" (Issued At) is a Unix timestamp for when the token was created. "exp" (Expiration) is when the token becomes invalid. Both are seconds since January 1, 1970 UTC. Divide by 1000 and use new Date() in JavaScript to convert to human-readable time.
What is the difference between JWT Debugger and JWT Inspector? ▼
Both tools decode JWT tokens. JWT Inspector provides additional timestamp analysis, displaying iat, exp, and nbf claims in human-readable UTC datetime format alongside the raw values. Use either for basic inspection.
Is JWT debugger free to use? ▼
Yes. JWT debugger is completely free and runs locally in your browser — no account required.
Does Nadhebe upload my data? ▼
No. All processing happens in your browser. Your input data never leaves your device or gets sent to any server.
Related Free Utilities
View all tools →Base64 encoder
Base64 encoder. Use this privacy-first base64 encoder directly in your browser.
URL parser
URL parser. Use this privacy-first url parser directly in your browser.
JWT inspector
JWT inspector. Use this privacy-first jwt inspector directly in your browser.
Json Validator
Browser native Json Validator utility.