Decode, debug, and verify JSON Web Tokens (JWT) in your browser. Inspect headers, payload claims, and expiration without sending tokens over the network.
Loading tool...
JWT Debugger is a specialized diagnostic utility built for backend software engineers, API developers, and cybersecurity analysts who need to inspect, decode, and verify JSON Web Tokens (RFC 7519). Widely utilized across modern OAuth 2.0, OpenID Connect (OIDC), and microservice architectures, JWTs encapsulate user identity claims, permission scopes, and session validity. JWT Debugger deconstructs token structures, formats claim payloads, validates expiration timestamps, and highlights potential security anti-patterns without transmitting sensitive tokens or secret keys across network connections.
The tool performs client-side base64url decoding (RFC 4648 §5) on the three period-separated components of a standard JWS token: Header, Payload, and Signature. The Header is parsed to inspect the cryptographic algorithm (e.g. HS256, RS256, ES256, EdDSA) and token type. The Payload is formatted into structured JSON, highlighting standard registered claims including subject (sub), issuer (iss), audience (aud), expiration time (exp), not-before time (nbf), issued-at (iat), and unique JWT ID (jti). Expiration timestamps are compared against the local system clock in real time to calculate time-to-expiry and detect clock skew. The debugger flags security vulnerabilities such as algorithm confusion risks and insecure tokens, executing all logic in client volatile memory.
Sample token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfOGE5ZjdjMTIiLCJpc3MiOiJhdXRoLm91dGxpdm8udGVjaCIsImF1ZCI6ImFwaS5vdXRsaXZvLnRlY2giLCJleHAiOjE3NzE0MDgwMDAsImlhdCI6MTc3MTQwNDQwMCwianRpIjoiYzM0YmQyOWYtMjM4OS00MTQxLWE3ZjAtYzg4ZjFlZjBiZjc0Iiwicm9sZXMiOlsidXNlciIsImFkbWluIl19.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXkHeader: {"alg":"HS256","typ":"JWT"} | Payload: {"sub":"usr_8a9f7c12","iss":"auth.outlivo.tech","aud":"api.outlivo.tech","exp":1771408000,"iat":1771404400,"jti":"c34bd29f-2389-4141-a7f0-c88f1ef0bf74","roles":["user","admin"]}Illustrative sample token demonstrating parsing and claim inspection. The sample signature illustrates token structure and is not verified against an active production secret; validity and expiration must be checked on an authenticating server relative to the current system clock.
Sample Payload: {"sub":"usr_dev_104","iat":1700000000,"exp":1700003600}Validation Flag: EXPIRED (Current UTC exceeds exp by >5,000 hours)Compares integer epoch timestamp against local system clock to illustrate why authentication middleware rejected an expired request with HTTP 401 Unauthorized. Note that parsing local timestamps does not verify signature authenticity.
A JSON Web Token consists of three base64url-encoded strings separated by periods: the Header (specifying cryptographic algorithm and token type), the Payload (containing registered and custom claims like user ID, roles, and expiration), and the cryptographic Signature (used to verify that the sender is authentic and the token has not been tampered with).
Standard claims establish token identity: "sub" (subject) identifies the principal/user ID, "iss" (issuer) specifies the authentication authority, "aud" (audience) defines the intended recipient API, and "jti" (JWT ID) provides a globally unique token identifier frequently used in token revocation lists and anti-replay defense mechanisms.
JWT tokens are signed, not encrypted (unless using JSON Web Encryption / JWE). Base64url encoding is a data serialization format, not encryption. Anyone possessing the token string can decode and read header and payload claims; the signature merely proves that the claims were not modified in transit.
The debugger compares integer epoch timestamps (exp for expiration, nbf for not-before, and iat for issued-at) against your current UTC system clock. When building backend verification, it is best practice to allow a small clock skew tolerance (typically 30 to 60 seconds) to account for minor time drift across distributed cloud servers.