Free Online JWT Debugger
Decode and inspect JSON Web Tokens (JWT) directly in your browser. View header, payload claims, expiry status, and token health timeline with zero server transmission — your token never leaves your device.
How to Use JWT Debugger
- Paste Encoded Token: Paste your raw JSON Web Token (e.g. eyJhbGciOi...) into the encoded token textarea.
- Inspect Decoded Header: Review the header JSON to verify the cryptographic signing algorithm (alg) and token type (typ).
- Analyze Payload Claims: Review user subject (sub), issuer (iss), audience (aud), and custom claims in formatted JSON.
- Verify Expiration Status: Check the visual token health indicator to see whether the token is currently active or expired.
Operational Limits & Specifications
| Processing Tier | Client-Side (In-Browser Execution) |
|---|---|
| Max File Size | 1 MB per file |
| Max Batch Quantity | Up to 1 files |
| Max Total Batch Size | 1 MB total |
| Supported Formats | .jwt, .txt |
Common Use Cases
OAuth 2.0 & OpenID Connect Debugging
Inspect ID tokens and access tokens issued by Auth0, Okta, Firebase, or Keycloak to verify user scopes and roles.
Token Expiration & Health Triage
Determine if an API 401 Unauthorized error is caused by an expired token (exp claim) or invalid issued-at timestamp (iat).
Verifying Custom Claim Payloads
Check that backend microservices are correctly embedding tenant IDs, user permissions, and email claims in outbound tokens.
Security Auditing & Algorithm Verification
Confirm tokens utilize secure signing algorithms (like RS256 or ES256) rather than insecure 'none' algorithms.
Technical Mechanics & Architecture
Comparison with Alternatives
Tips & Troubleshooting
- Never paste production JWTs containing sensitive secrets into third-party web tools that upload tokens to backend servers.
- Check the 'exp' claim timeline to see exact human-readable expiration dates in both UTC and your local device time zone.
- If your token contains URL-safe Base64 encoding without padding, our parser automatically normalizes it prior to decoding.
- Inspect the header block to verify whether your token uses symmetric (HS256) or asymmetric (RS256/ES256) key signing.
Frequently Asked Questions
Is it safe to paste confidential production JWTs into this tool?
Yes. All decoding occurs 100% locally in your web browser. Your token is never transmitted across the network, logged, or saved to any server.
What are the three components of a JWT?
A JWT consists of a Header (identifying algorithm and token type), a Payload (containing user and authorization claims), and a Cryptographic Signature (verifying token authenticity).
How are timestamps like 'exp' and 'iat' converted?
JWT timestamps represent Unix epoch seconds. The debugger converts these numbers into human-readable local dates and relative times (e.g. 'expires in 45 minutes').
Can this tool verify asymmetric signatures (RS256)?
The debugger decodes and inspects the token claims. For symmetric HS256 tokens, you can provide an HMAC secret to verify signatures locally in your browser.
What does an expired token look like in the debugger?
If the current timestamp exceeds the 'exp' claim value, an alert highlights that the token has expired, along with the elapsed time since expiration.
Does this tool work offline?
Yes. Once the web page is loaded, the JWT debugger operates completely offline with zero internet connectivity required.