How to decode a JWT token in 3 easy steps
- 1
Paste your token
Copy the full JWT (all three parts separated by dots) and paste it into the input box.
- 2
Read the decoded output
The header (algorithm, type) and payload (claims) are shown as readable JSON with dates converted from Unix timestamps.
- 3
Check expiry and signature
The tool flags expired tokens and tells you whether the signature segment is present and correctly structured.
Why use the jwt debugger tool from Super Utility Hub?
Debug JWT tokens without sending them to a third-party website. Paste any JWT — the eyJ... token from your app's auth flow — and this tool decodes the header and payload locally, showing every claim, timestamps as human-readable dates, and whether the token has expired.
JWT stands for JSON Web Token: three Base64url-encoded parts separated by dots — header, payload, and signature. This debugger decodes the first two and verifies the signature is structurally present (it does not validate cryptographic signatures, which requires the secret).
Because decoding happens entirely in your browser, you can safely inspect production tokens that contain user data. Free, instant, and no account required.
- Processes everything in your browser — no upload servers involved
- Free forever with unlimited uses
- Works on Windows, macOS, Linux, Android and iOS
- No watermark or branding on your output, ever
Frequently asked questions
Is it safe to paste my JWT here?
Yes. Decoding runs 100% locally in your browser — the token is never transmitted, so it's safer than pasting into online JWT sites that may log it.
Does the tool validate the signature?
It checks the signature segment exists and is valid Base64url. Verifying authenticity requires the signing secret (HMAC) or public key, which only the issuing server has.
What are the standard JWT claims?
exp (expiry), iat (issued at), nbf (not valid before), iss (issuer), sub (subject), and aud (audience). The tool converts timestamps to readable dates and flags expired tokens.
Can I decode tokens from any provider?
Yes — any standards-compliant JWT from Auth0, Firebase, Keycloak, .NET, Java, Node.js, or a custom server decodes here, as long as it uses standard Base64url encoding.