The header typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.

The payload contains the claims. Claims are statements about an entity (typically, the user) and additional data.

Can I edit the JWT here?

This tool is primarily a debugger/viewer. Editing a signed JWT invalidates the signature unless you re-sign it with the correct secret key.

JWT Debugger - Decode & Debug JSON Web Tokens

What is a JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

JWT Structure

A JWT is a string comprising three Base64URL-encoded parts: the Header (Algorithm & Token Type), the Payload (Data/Claims), and the Signature. These parts are concatenated with a dot (.) separator:

header.payload.signature

Common Use Cases

Authorization: The most common scenario. Once the user is logged in, each subsequent request will include the JWT, allowing the user to access routes, services, and resources.
Information Exchange: JWTs are checking valid credentials between parties.
Stateless Sessions: No need to keep session data on the server; the token contains all necessary user info.

Privacy & Security

Your security is our priority. All JWT decoding and verification logic happens client-side in your browser JavaScript. No tokens, headers, or payloads are ever sent to our servers.

100% Browser-Based

How to use the JWT Debugger

1
Paste a token (it starts with eyJ) into the Encoded box. The header and payload are decoded instantly and shown as formatted JSON.
2
Check the standard claims. Times such as exp, iat and nbf are shown as readable dates, so you can see at once whether the token is expired or not yet valid.
3
To verify the signature, enter the HMAC secret (HS256/384/512) or the public key in PEM format (RS256/384/512, ES256/384/512). The tool reports whether the signature matches.
4
Switch to Generator mode to create a test token: edit the payload, choose an algorithm, enter a secret or private key and copy the signed JWT.

Practical examples

Debugging 401 errors

An API rejects your request with 401 Unauthorized. Decode the token to find an expired exp, a wrong aud (audience) or a missing scope claim.

Checking identity provider tokens

Inspect ID tokens from Auth0, Keycloak, Firebase or Azure AD to see which claims (email, roles, groups) your application really receives.

Testing role-based access

Generate tokens with role "admin" and role "viewer" signed with your development secret to test both paths of an authorization check.

Verifying key rotation

After rotating keys, paste a fresh token and the new public key to confirm that the kid in the header and the signature match the new key.

Frequently asked questions

Is a JWT encrypted?+

Usually not. A standard JWT (JWS) is only Base64URL encoded and signed. Anyone can read the payload, so never put passwords or sensitive personal data in it. Encrypted tokens (JWE) are a different format.

What do the three parts mean?+

header.payload.signature: the header names the algorithm and token type, the payload holds the claims, and the signature proves that the first two parts were created by someone holding the key and were not modified.

Is it safe to paste a production token here?+

Decoding and verification run entirely in your browser and nothing is sent to our server. Even so, a valid token works like a password until it expires, so prefer test tokens or revoke real ones after debugging.

HS256 or RS256, which should I use?+

HS256 uses one shared secret for signing and verifying, which is simple for a single service. RS256 and ES256 sign with a private key and verify with a public key, which suits systems where many services verify tokens issued by one authority.