See Inside the Token: The Ultimate JWT Decoder

Modern authentication runs on JSON Web Tokens (JWT). Whether you are using Auth0, Firebase, or a custom Node.js backend, these tokens are the keys to your application. However, because they are Base64 encoded, they look like gibberish to the human eye. Our Advanced JWT Debugger allows you to instantly decode the three parts of a token to view the hidden data (claims), verify the signature to ensure it hasn't been tampered with, and validate expiration times.

The Anatomy of a JWT

A JWT is not encrypted; it is encoded. It consists of three distinct sections separated by dots (.):

Header (Red): Defines the algorithm used (e.g., HS256) and the token type.
Payload (Purple): The actual data. This contains standard "Claims" like sub (Subject/User ID), iat (Issued At), and exp (Expiration Time), along with any custom data like "role: admin".
Signature (Blue): The security seal. It is a mathematical hash of the Header + Payload + Your Secret Key. If even one character of the payload changes, the signature breaks.

How Signature Verification Works

Decoding a token is easy—anyone can do it. Verifying it is the hard part. This tool allows you to paste your Secret Key (for HS256) or Public Key (for RS256) to check the signature.

Success: If the signature matches, the token is authentic and was issued by your server.
Failure: If the signature fails, the token has been tampered with or the secret is wrong.

Common Debugging Scenarios

"Token Expired" Errors: Check the exp timestamp. This tool converts the Unix timestamp (e.g., 1678900000) into a human-readable date so you can see exactly when the token died.
"Invalid Signature": You might be using the wrong secret, or an attacker tried to modify the payload (e.g., changing their role from "user" to "admin").
Clock Skew: Sometimes the server time and client time are slightly out of sync.

Frequently Asked Questions

Is it safe to paste my JWT here?

Yes. This tool runs 100% on the Client-Side. Your tokens and secret keys are processed by JavaScript in your browser and are never sent to our servers. However, for high-security production keys, we always recommend rotating them if you feel uncomfortable.

What is the difference between HS256 and RS256?

HS256 (Symmetric): Uses one secret key to both sign and verify. Faster, but you must keep the key safe.
RS256 (Asymmetric): Uses a Private Key to sign (server only) and a Public Key to verify (anyone). This is more secure for distributed systems.