JWT Debugger

A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe representation of claims between two parties. It is made of three Base64Url-encoded sections separated by dots: a header describing the signing algorithm, a payload of claims (such as the user ID, issue time, and expiry), and a signature computed over the first two parts (typically with a SHA-based HMAC). Servers issue JWTs after a successful login and clients send them back on subsequent requests to prove identity.

This debugger decodes the header and payload locally in your browser so you can inspect what a token actually contains. Decoding is not the same as verifying — anyone can read a JWT — but it is invaluable for understanding why an authentication call is failing or what an API gateway is forwarding downstream. Because the decode happens entirely client-side, it is safe to paste production tokens here.

1. Paste a JWT (the long string with two dots) into the input field.
2. The header and payload sections decode immediately and render as syntax-highlighted JSON.
3. Read the standard claims: iss (issuer), sub (subject), exp (expiry), iat (issued-at), and any custom claims your service uses.
4. If you need to verify the signature, copy the relevant section into your verification library along with the public key or shared secret.

• Debugging "401 Unauthorized" responses by checking whether the token is expired or missing a required scope.
• Inspecting the claims forwarded by an API gateway to backend services.
• Confirming that an OAuth2 access token was issued by the correct authorization server.
• Teaching new team members what is and isn't safe to put in a JWT payload.