Debug JWT Tokens in 30 Seconds
Learn how to decode and debug JWT tokens instantly. Inspect header, payload, and expiration without writing any code.
The Problem
Your API returns 401 Unauthorized and you have no idea what's inside the JWT token. Is it expired? Wrong audience? Bad claims? You could write a script, or use jwt.io — but there's a faster way.
Why This Matters
JWT tokens are the backbone of modern API authentication (OAuth 2.0, OpenID Connect, Firebase Auth, Auth0). Being able to instantly inspect a token's payload during development saves hours of debugging. You'll immediately see expiry timestamps, user ID, roles, and any custom claims — without installing anything.
Step-by-Step Instructions
Copy your JWT token
Grab the token from your browser's DevTools (Network tab → Authorization header), your app logs, or a curl response. It starts with eyJ.
Paste into the decoder below
Paste the full token into the input field. The decoder splits and decodes all three parts (header, payload, signature) instantly.
Inspect header and payload
The header shows the algorithm (e.g., HS256, RS256). The payload contains your claims: sub (user ID), exp (expiry), iat (issued at), and any custom fields.
Check expiration
The decoder converts the exp Unix timestamp to a human-readable date. If it shows "Expired", your token is invalid — you need to refresh it.
Try It Now — JWT Decoder
Open full page →All processing happens in your browser — no data is sent to any server.
Before & After Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEyMyIsImVtYWlsIjoiYWxpY2VAZXhhbXBsZS5jb20iLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3MDk4MDA0MDAsImV4cCI6MTcwOTgwNDAwMH0.signature
{
"sub": "user_123",
"email": "[email protected]",
"role": "admin",
"iat": 1709800400, // Issued: 2026-03-07 10:00:00
"exp": 1709804000 // Expires: 2026-03-07 11:00:00
}
Frequently Asked Questions
Is it safe to paste my JWT token here?
Yes. The JWT decoder runs entirely in your browser — no data is sent to any server. That said, never share tokens that grant access to production systems.
Does this verify the JWT signature?
No. Decoding and verification are different operations. This tool only decodes the Base64-encoded parts. Signature verification requires the secret key and should happen server-side.
Why does my token show as expired?
The exp claim is a Unix timestamp. If the current time is past that value, the token is expired. You need to obtain a new token via your auth flow.
Related Workflows
Want the full JWT Decoder experience?
Open the standalone tool for more space, keyboard shortcuts, and additional features.
Open JWT Decoder →