JWT Debugger
Paste your token below. Algorithm is detected automatically.
{}{}base64UrlEncode(header) + "." +
base64UrlEncode(payload),
your-256-bit-secret
)
Frequently asked questions
Is it safe to paste a JWT here?
Yes. The token is decoded and verified entirely in your browser — it is never sent to a server. That said, a JWT is a credential: avoid pasting production tokens into any online tool you do not control, and treat this one as you would a local script.
Does decoding a JWT reveal the signing secret?
No. The header and payload of a JWT are only Base64URL-encoded, not encrypted, so anyone can read them. The signature proves the token has not been tampered with, but it does not expose the secret or private key used to sign it.
What do the exp, iat and nbf claims mean?
They are Unix timestamps: iat is when the token was issued, exp is when it expires, and nbf (not before) is the earliest time it becomes valid. The debugger converts these to human-readable dates and flags whether the token is currently expired.