JWT Debugger
Decode and inspect JSON Web Tokens instantly. Processed locally for total privacy.
// Header will appear here
// Payload will appear here
Understanding JWT
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.
Structure of a JWT
A JWT is composed of three parts separated by dots: **Header**, **Payload**, and **Signature**. It looks like: `xxxxx.yyyyy.zzzzz`
- **Header**: Contains info about the algorithm and token type.
- **Payload**: Contains the claims (user data).
- **Signature**: Used to verify the message hasn't been changed along the way.
Understanding JSON Web Tokens
A JSON Web Token (JWT) is a compact, self-contained way to transmit claims between two parties, most often used for authentication and authorization. After you log in, a server can hand you a signed token that you present on later requests to prove who you are — without the server having to look you up in a session store every time.
The three parts of a token
A JWT is three Base64URL-encoded segments separated by dots: the header, the payload, and the signature. The header describes the signing algorithm, the payload carries the claims (the actual data), and the signature lets the recipient verify the token hasn't been tampered with. Decoding the first two parts is trivial — which is exactly why you must never store secrets in them.
What lives in the payload
The payload holds 'claims' such as the subject (sub), issuer (iss), issued-at time (iat), and expiry (exp), alongside any custom data your application needs. Because anyone can read it, treat the payload as public information and rely on the signature — not secrecy — for trust.
Security essentials
Always verify the signature before trusting a token, and always check the expiry. Use a strong secret or key, prefer short-lived tokens with refresh flows, and never accept the 'none' algorithm in production. Decoding a token to inspect it (as this tool does, locally) is safe; trusting an unverified token is not.
Quick tips
- A JWT is encoded, not encrypted — anyone can read the payload.
- Never put passwords or secrets inside the payload claims.
- Always validate the exp (expiry) and the signature server-side.
- Decoding here happens in your browser; your token is never uploaded.
Frequently Asked Questions
Common questions about the Online JWT Debugger.