About JWT Decoder & Debugger
BestOfTool's JWT Decoder & Debugger is a free, browser-based tool for inspecting JSON Web Tokens. Paste any compact JWT and instantly see the decoded header, payload, and registered claims — including expiration status with readable dates. All decoding happens in your browser. Your token is never sent to any server.
JWT Decoder & Debugger Example
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vLXVzZXItNDIiLCJpc3MiOiJiZXN0b2Z0b29sLmNvbSJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cOutput
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"demo-user-42","iss":"bestoftool.com"}How JWT Decoder & Debugger Works
- 1Paste your JWT token (compact header.payload.signature format) into the input area, or click "Load Sample" to see a demonstration token.
- 2The tool instantly decodes the Base64URL-encoded header and payload segments using browser-native APIs — no server is involved.
- 3Inspect the Token Summary for key fields: algorithm, type, issuer, subject, audience, and expiration status.
- 4Check the Time Claims section to see exp, nbf, and iat claims converted from NumericDate (seconds since epoch) to readable UTC dates with relative time.
- 5Review the Decoded Header and Decoded Payload as formatted JSON, and use the Copy buttons to copy them to your clipboard.
- 6The Signature Segment is displayed separately with a clear notice that it has not been verified.
JWT Decoder & Debugger Use Cases
- ✓Quickly inspect the contents of a JWT returned by an authentication server or API.
- ✓Debug expiration issues by checking exp, iat, and nbf claim values as human-readable dates.
- ✓Understand which claims are present in a token during development and integration testing.
- ✓Verify that a token carries the expected audience, issuer, or subject before deeper debugging.
- ✓Identify tokens with unusual headers such as alg: none that may indicate security issues.
- ✓Learn about JWT structure, Base64URL encoding, and registered claims in an educational context.
- ✓Cross-check NumericDate (seconds since epoch) values against the Unix Timestamp Converter.
JWT Decoder & Debugger — Frequently Asked Questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe format for representing claims between two parties, defined in RFC 7519. The most common form is a signed JWT (JWS) consisting of three Base64URL-encoded segments separated by dots: a header, a payload, and a signature. JWTs are widely used for authentication and authorization in web applications and APIs.
How do I decode a JWT?
Paste your JWT into the input field above. The tool splits the token on dots, Base64URL-decodes each segment using browser-native APIs, and displays the header and payload as formatted JSON. The signature segment is shown separately as raw Base64URL.
Does decoding a JWT verify its signature?
No. Decoding a JWT reveals its contents — it does not verify the cryptographic signature. To trust a JWT's claims, the signature must be verified by the consuming application using the correct secret or public key. This tool is a decoder and inspector, not a verifier.
Is it safe to decode a JWT here?
JWT decoding happens entirely in your browser — your token is not sent to any server. However, JWTs can contain sensitive information such as user identifiers, roles, or email addresses. Avoid pasting production tokens into any online tool, including this one.
Can anyone read a JWT payload?
Yes. In the common signed JWT (JWS) form, the header and payload are only Base64URL-encoded, not encrypted. Anyone who possesses the token can decode and read the payload. A signature provides integrity and authenticity when verified — it does not make the payload confidential. Do not place sensitive data in JWT claims unless you are using encrypted JWTs (JWE).
Is a JWT encrypted?
Not by default. The common signed JWT (JWS) encodes the header and payload in Base64URL, which is trivially reversible. Encrypted JWTs (JWE) do encrypt the payload, but they have a five-segment structure and are less common. This tool decodes signed JWTs (JWS) only.
What are the three parts of a JWT?
A compact signed JWT (JWS) has three dot-separated segments: (1) the Header — a JSON object containing the algorithm (alg) and token type (typ); (2) the Payload — a JSON object containing claims about the subject and other data; (3) the Signature — a cryptographic signature over the header and payload that allows the recipient to verify authenticity when using the correct key.
What does exp mean in a JWT?
exp (Expiration Time) is a registered JWT claim containing a NumericDate — the number of seconds since 1970-01-01T00:00:00Z (the Unix epoch). A JWT must not be accepted on or after the time represented by exp. An expired token should be rejected by the consuming application regardless of whether the signature is valid.
What does iat mean in a JWT?
iat (Issued At) is a registered JWT claim containing a NumericDate representing the time the JWT was issued. It is expressed as seconds since the Unix epoch (1970-01-01T00:00:00Z). It can be used to determine the age of the token.
What does nbf mean in a JWT?
nbf (Not Before) is a registered JWT claim containing a NumericDate. The JWT must not be accepted before the time represented by nbf. This allows issuing tokens that become valid at a future point.
How do I know if a JWT is expired?
When the exp claim is present, this tool compares it against the current time and displays "Expired according to exp" or "Not expired according to exp". Note that even a non-expired token is not trustworthy until its signature and other relevant claims have been verified by the consuming application.
What is Base64URL?
Base64URL is a variant of standard Base64 encoding (RFC 4648 §5) that is safe for use in URLs and filenames. It uses - instead of + and _ instead of /, and omits the padding = character. JWT segments are Base64URL-encoded, not standard Base64.
Does this tool upload my JWT?
No. JWT decoding happens entirely in your browser using browser-native JavaScript APIs. Your token is never sent to any server.
Can I trust claims from a decoded JWT?
No — not without proper verification. A decoded JWT reveals the claims the token contains, but anyone can construct a JWT with any payload. To trust the claims, you must verify the signature using the correct key for the declared algorithm, and validate that the issuer, audience, expiration, and other relevant claims are acceptable for your application.
What does alg: none mean in a JWT?
alg: "none" means the token declares it has no cryptographic signature. Some early JWT libraries accepted these tokens unsafely. A well-implemented application should explicitly reject alg: none tokens or require an explicit allowlist. Do not treat claims from an alg: none token as authenticated.
JWT Decoder & Debugger Key Features
Correct Base64URL Decoding
Properly handles the - and _ characters used in Base64URL, restores omitted padding, and decodes bytes to UTF-8 using TextDecoder — supporting international characters and emoji without corruption.
NumericDate Claim Inspector
exp, nbf, and iat claims are always treated as seconds since the Unix epoch (RFC 7519), displayed as readable UTC/ISO dates with relative time.
Expiration & Not-Before Status
Clearly shows "Not expired according to exp" or "Expired according to exp" — never the misleading "valid token" label, because decoding is not verification.
Registered Claims Inspector
iss, sub, aud, exp, nbf, iat, and jti are identified, labelled, and explained. aud is handled correctly as either a string or an array of strings.
alg: none Warning
Tokens declaring alg: "none" receive a prominent informational warning explaining that no cryptographic signature is present.
Privacy First
JWT decoding happens entirely in your browser. Your token, decoded claims, and any copied content are never sent to analytics or any server.
Related Developer Tools
Why Use Our JWT Decoder & Debugger?
JWT (JSON Web Token) is the most widely used format for authentication tokens in modern web applications and APIs. Understanding what a token contains — its algorithm, issuer, subject, audience, expiration time, and other claims — is a daily task for backend developers, security engineers, and anyone integrating with OAuth 2.0 or OpenID Connect systems.
A critical distinction that this tool emphasises: decoding a JWT reveals its contents, but does not verify its authenticity. The header and payload are only Base64URL-encoded, not encrypted or authenticated by the act of decoding. Signature verification — using the correct secret or public key — is the responsibility of the consuming application. This decoder helps you inspect and understand tokens; it explicitly cannot and does not confirm that a token is genuine or safe to trust.