What are the three parts of a JWT?

A JWT has a header, a payload, and a signature, separated by dots. The header names the signing algorithm, the payload holds the claims, and the signature verifies the token was not altered. The first two parts are Base64URL-encoded, not encrypted.

Can anyone read the contents of a JWT?

Yes. The header and payload are only Base64URL-encoded, so anyone with the token can decode and read them. JWTs are signed, not encrypted, which means you should never put secrets in the payload.

How do I check if a JWT is expired?

Look at the exp claim in the payload, which is a Unix timestamp. This tool compares it to the current time and shows the expiration status directly, so you don't have to convert the timestamp yourself.

Does this tool verify the JWT signature?

This debugger decodes and displays the token contents and reports expiration. Verifying the signature requires the secret or public key that signed it, which is done server-side; decoding alone does not prove authenticity.

Is my JWT sent to a server when I decode it?

No. Decoding runs entirely in your browser, so the token never leaves your device. That makes it safe to inspect real session or production tokens.

JWT Debugger / Decoder

Decode and inspect JSON Web Tokens (JWTs). Instantly view header, payload, signature, and expiration status. Paste your JWT below to analyze its contents.

JWT Input

Paste the full JSON Web Token string here.

About JWT Debugger / Decoder

A JSON Web Token looks like one long opaque string, but it's actually three Base64URL-encoded parts separated by dots: a header, a payload, and a signature. The header says which algorithm signed it, the payload carries the claims (who the user is, when the token expires, what scopes they hold), and the signature proves the token hasn't been tampered with. Most of the time when something is broken, the answer is sitting in the payload — you just can't read it by eye.

This debugger splits the token apart and renders each section as readable JSON. You see the algorithm, every claim, and — crucially — whether the token is still valid right now. It reads the exp and iat claims and tells you plainly whether the token has expired, which is usually the first thing you check when an authenticated request suddenly starts returning 401.

Decoding happens entirely in your browser. The token is never transmitted, so you can safely inspect production tokens, customer session tokens, or anything carrying real claims without it leaving your machine.

How to use JWT Debugger / Decoder

Paste the token
Copy the full JWT — all three dot-separated segments — and paste it into the input. You can grab it from an Authorization header, a cookie, or local storage.
Read the header
The decoded header shows the signing algorithm (such as HS256 or RS256) and token type, which tells you how the signature was produced.
Inspect the payload claims
The payload lists every claim — subject, issuer, audience, scopes, and any custom fields your application set.
Check expiration
Look at the expiration status to see whether the token is still valid or has already expired, the most common cause of unexpected 401 responses.

Frequently asked questions

JWT Faker

Decode, verify (HMAC), and generate JSON Web Tokens (JWT) directly in your browser.

Base64 Encoder / Decoder

Encode text or files to Base64, or decode Base64 back to its original form. Supports text input and file drag-and-drop.

Hash Generator & Verifier

Generate MD5, SHA-1, SHA-256, SHA-512, and bcrypt hashes. Verify strings against known hashes.