Inspect and Debug JSON Web Tokens
JSON Web Tokens are the standard way modern APIs pass authentication and authorization data between services. A JWT looks like a long opaque string, but it is actually three Base64URL-encoded JSON objects concatenated with dots. This tool splits the token, decodes each part, pretty-prints the JSON, and highlights the claims that matter most — algorithm, issuer, subject, expiration, and any custom fields your application adds.
The Three Parts of a JWT
The header declares the token type (almost always"JWT") and the signing algorithm (HS256, RS256, ES256, and others). The payload carries the claims — registered fields like issuer, subject, audience, and expiration, plus any custom data the application needs to convey. The signature is a cryptographic hash of the header and payload using the algorithm declared in the header, ensuring that the token has not been modified in transit.
Checking Token Expiration
The"exp" claim is a Unix timestamp representing the moment the token becomes invalid. When debugging authentication failures, the first thing to check is whether the token has expired. This tool compares the exp value against your device's current clock and shows a clear status — expired with the exact time, or valid with time remaining. It also decodes the"iat" (issued at) and"nbf" (not before) timestamps into human-readable dates.
Common Debugging Scenarios
API returning 401 Unauthorized? Decode the token to check if it has expired, if the audience claim matches the API you are calling, or if a required custom claim like"scope" or"role" is missing. Getting 403 Forbidden? The token may be valid but the payload may lack the permission the endpoint requires. Seeing"invalid signature" errors? Check the header's algorithm — a mismatch between what the server expects and what the token declares is a frequent cause.
Base64URL vs Standard Base64
JWTs use Base64URL encoding, not standard Base64. The differences are small but critical: the"+" character is replaced with"-","/" is replaced with"_", and trailing"=" padding is stripped. This makes the token safe to include in URLs, HTTP headers, and query parameters without additional escaping. The decoder handles this automatically — you paste the raw token and get readable JSON.
Security: Decoding Is Not Verification
Anyone can decode a JWT — the header and payload are only encoded, not encrypted. Decoding tells you what the token claims but not whether those claims are trustworthy. Verification requires the signing key: an HMAC secret for HS algorithms, or a public key for RS and ES algorithms. Never trust a decoded token in production without server-side signature verification. This tool is for inspection and debugging, not for access control decisions.