Check a JWT for expiry and claims

Decode JWT header, payload, and signature segments for inspection.

freeworks offlinenothing uploaded
ToolJWT Debugger
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

A compact token is split at periods, each Base64url segment is decoded into header, payload, and signature bytes, and JSON claims are displayed. Verification requires the algorithm, key, issuer, audience, and policy to be supplied separately.

  • Three compact segments and unpadded Base64url keep JWTs portable in headers.

Worked example

Analyze an expired JWT token
Debug a JWT to find expiration issues and missing claims
Input
											eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiZXhwIjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output
												=== JWT Debug Report ===

Parts count: 3

--- Header ---
{
  "alg": "HS256",
  "typ": "JWT"
}
Algorithm: HS256

--- Payload ---
{
  "sub": "1234567890",
  "name": "John Doe",
  "exp": 1516239022
}
Expires: 2018-01-18T01:30:22.000Z
Subject: 1234567890

--- Signature ---
Signature length: 43 characters
Signature (base64url): SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

--- Summary ---
Issues found: 1

When to use this

API debugging, identity-claim reviews, and algorithm checks inspect JWTs.

Edge cases

  • A token with alg=none can decode but must not be trusted automatically.
  • Malformed Base64url can make only one segment unreadable.
  • A readable payload is not proof of signature validity.

References