Decode JWT Token Online Safely
Decode JWT headers and payloads locally in your browser, inspect claims, and verify HMAC signatures when you have the secret.
Written by Anil Gautam · Updated
How do you read a JWT's claims and dates?
A signed JWT is three base64url strings joined by dots: header, payload and signature. The debugger splits the token at the dots and decodes the first two parts as UTF-8 JSON. Base64url is an encoding, so anyone holding a token can read its claims this way; only the signature depends on a key. A token with five parts is an encrypted JWE and stops with "JWT must have 3 parts: header.payload.signature". If you copied the value from an Authorization header, delete the "Bearer " prefix first, or the header part will not decode.
The Registered claims card turns iat (issued at), nbf (not before) and exp (expires) from Unix seconds into your local time, followed by the UTC time in ISO format. A payload with "iat": 1790000000 and "exp": 1790003600 shows an issue time of 2026-09-21T14:13:20.000Z and an expiry 3,600 seconds later, at 15:13:20 UTC. The tool does not compare these times with the current clock, so judge expiry yourself. If Expires shows a year such as 58692, the server wrote milliseconds where the standard expects seconds. Claims such as iss, sub and aud appear only in the Decoded Payload box, and the Unix Timestamp Converter turns any other timestamp claim into a date.
Why does a JWT signature fail to verify?
Verify signature uses the browser's Web Crypto API, so the token and the secret stay on your device. It signs the first two parts, exactly as they appear in the token, with HMAC using SHA-256, SHA-384 or SHA-512 according to the alg field (HS256, HS384 or HS512), encodes the result as base64url and compares it with the third part.
The secret is used exactly as typed, as UTF-8 text. A trailing space picked up while copying gives "Signature does not match" even when the key is right. Some systems store the key base64-encoded and decode it before signing, and in that case the encoded text you paste is a different key. Tokens signed with RS256, ES256 or another public-key algorithm, and unsigned tokens with alg none, get "Only HMAC JWTs can be verified in this tool right now". Editing the token clears the last result, so press Verify signature again after any change. The secret box shows the key in plain text, so avoid typing a production secret on a shared screen.