JWT Debugger — Decode a JSON Web Token and Verify Its Signature

How to use the JWT debugger

1. Paste the token into JWT. It has three parts separated by dots.
2. To verify the signature, enter the Secret or public key. For HS algorithms that is the shared secret. For RS, PS or ES it is a PEM public key or a public JWK.
3. If your HS secret is stored as Base64 or hex, choose it under Secret encoding.
4. Read the verification message at the top, then the decoded Header, Payload and Claims table.
5. Check the notice that says whether the token has expired or is not valid yet.

What it does and when to use it

JSON Web Tokens carry identity and permissions between services. When login breaks or an API returns 401, the first step is to look inside the token. This debugger shows you exactly what it says and whether its signature holds up.

Use it to:

• Read the claims in a token from your identity provider or API.
• Check expiry, issued-at and not-before times as real dates.
• Confirm that a token was signed with the secret or key you expect.
• Spot a token that was created with milliseconds instead of seconds.
• Teach or learn how JWTs are built.

To create a test token with your own claims, use the JWT Generator. To convert any single timestamp, try the Unix Timestamp converter. The header and payload are Base64URL, which the Base64 Decoder can also read.

How it works

A JWT is three Base64URL strings joined by dots: header, payload and signature. The tool decodes the first two into JSON and lists every claim, with a short meaning for standard ones such as iss, sub, aud, exp, nbf, iat and jti. Time claims are converted from seconds to ISO dates, with how long ago or how far ahead they are.

To verify, it rebuilds the signing input (header and payload) and checks the signature with your secret or public key using the browser’s Web Crypto API (crypto.subtle). HMAC tokens use the secret. RSA, RSA-PSS and ECDSA tokens use the public key. Nothing leaves your device.

Worked examples

The well-known sample token. The jwt.io sample token (header {"alg":"HS256","typ":"JWT"}, payload with "sub":"1234567890", "name":"John Doe" and "iat":1516239022) checked with the secret your-256-bit-secret gives Signature verified (HS256). The issued-at claim is shown as 1516239022 = 2018-01-18T01:30:22Z.

The wrong secret. The same token checked with the secret wrong gives Invalid signature, explaining that it was not signed with that secret or was modified.

A broken token. abc.def gives A JWT has three parts separated by dots; this has 2.

Limits and tips

• Expiry is checked against your device’s clock. If your clock is wrong, the expiry notice will be too.
• Encrypted tokens (JWE, with five parts) cannot be decoded here.
• Verifying in a browser is for debugging. Your server must still verify every token itself, and should only accept the algorithms it expects.