Inspect JWT tokens in detail
When a token-based login misbehaves, the answer is usually inside the token. This debugger decodes a JWT and lays out its header and payload with highlighting, so you can read the claims clearly, check the expiry, and see which algorithm signed it. Since the payload is only encoded, not encrypted, you can read it without any keys.
How to use it
- Paste the JWT.
- Read the decoded header and payload with each claim highlighted.
- Check the claims that matter — especially expiry and audience.
What to inspect
- The expiry claim, a frequent cause of unexpected logouts.
- The issuer and audience, to confirm the token is meant for your service.
- The signing algorithm in the header.
Questions people ask
Does it verify the signature? No — it reads the contents. Verifying authenticity needs the signing key and belongs on your server.
Is pasting a token safe? Decoding is local to your browser, but treat real tokens as secrets and prefer expired or test tokens.