Is it safe to paste my JWT into this debugger?

Yes. JWT Debugger runs entirely in your browser using JavaScript — the token is never sent to any server, logged, or stored. You can even disable your network and it will still work. For maximum safety, however, avoid pasting production tokens that grant real access into any online tool.

What JWT algorithms are supported for decoding?

All of them. Because decoding does not require the signing key, JWTs signed with HS256, HS384, HS512, RS256, ES256, EdDSA, and even 'none' can all be decoded and displayed. The header's alg field is shown so you can spot suspicious values.

How do I know if a JWT is expired?

The tool reads the standard exp (expiration) claim, converts it from Unix seconds to your local time, and marks the token as Expired or Valid. It also shows iat (issued at) and nbf (not before) so you can see the full validity window.

Can I decode a JWT from a URL or Authorization header?

Yes. Paste any string that contains a JWT — the tool extracts the token even if you include prefixes like 'Bearer '. It looks for the three Base64URL-encoded segments separated by dots.

Free JWT Debugger

Decode any JWT in
one paste.

Instantly decode and inspect JSON Web Tokens — see the header, payload, algorithm, expiration, and every claim. Nothing is sent anywhere; it all runs in your browser.

🔐

Fully Client-Side

Tokens are decoded locally in your browser. No uploads, no logging, no server round-trip.

⏱️

Expiration Aware

See exp, iat, and nbf in human-readable time and instantly know if the token is valid or expired.

🧩

Every Claim, Explained

Pretty-printed JSON with descriptions for standard claims like iss, sub, aud, jti and more.

Encoded JWT

Header

No data

Payload

No data

Signature

—

Signature verification requires the issuer's secret or public key and is intentionally not performed here. Verify server-side with a JWT library.

Frequently Asked Questions

Everything you need to know about JWT Debugger.

Decode any JWT inone paste.