JWT Debugger

Developer & Data

Decode a JSON Web Token and inspect its header and payload.

Encoded token

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "admin": true,
  "iat": 1700000000,
  "exp": 1900000000
}

Timestamps

iatIssued at:Tue, 14 Nov 2023 22:13:20 GMT
expExpires:Sun, 17 Mar 2030 17:46:40 GMTValid

Signature

sVh7Vghpv9aG3Tq9m0m8kZ2m2m4Qd0oQ4iZ3aXn7d1Y

The signature is shown as-is but not verified. Verifying it requires the issuer's secret or public key, which is never entered here — so this tool only decodes the token, it does not confirm the signature is authentic. Never trust a decoded payload without server-side verification.

Decoded entirely in your browser. Your token is never uploaded or logged.

What is JWT Debugger?

JWT Debugger decodes a JSON Web Token and lays out its header, payload, and signature so you can see exactly what a token contains. It pretty-prints the JSON of each section and translates the iat, nbf, and exp timestamps into human-readable dates, flagging whether the token has expired. Decoding happens entirely in your browser — your token is never uploaded — and the signature is shown but not verified, because that requires a secret or key you should never paste into a website.

How to use JWT Debugger

Paste your token
Drop a JWT (it usually starts with eyJ) into the Encoded token box, or click Load sample to try a harmless example token.
Read the header
The Header panel shows the decoded JSON, including the signing algorithm (alg) and token type (typ), pretty-printed for easy scanning.
Inspect the payload
The Payload panel shows every claim in the token — subject, custom fields, roles, and standard registered claims.
Check the timestamps
Any iat, nbf, or exp claims are converted from Unix epoch seconds into readable UTC dates, with a badge showing whether the token is still valid or has expired.
Review the signature
The raw signature segment is displayed for reference. It is not verified — the tool clearly notes that authenticity checks require the issuer's key and must happen server-side.

Common uses

Inspect the claims inside a token returned by an auth API
Check whether a token has expired and when it was issued
Confirm which algorithm a token was signed with
Debug why a request is rejected by reading the payload roles or scopes
Learn how JWTs are structured into header, payload, and signature
Copy a decoded payload into a bug report or ticket

Why choose FreeTools

100% private

Your files are processed inside your browser and are never uploaded to a server.

Free, no account

No sign-up, no watermark, no paywalled “premium” tier. Just open a tool and use it.

Instant

No upload, no queue, no server round-trip — work starts the moment you drop a file.

Runs in your browser

Built on open web standards. Works on any modern desktop browser, nothing to install.

No upload size caps

Nothing leaves your device, so there’s no server file-size limit — only your machine’s memory.

Yours to keep

Results download straight to your device in clean, standard file formats.