JWT Debugger — Decode Any JSON Web Token, Instantly

JWT Debugger is a free, browser-based tool for decoding and inspecting JSON Web Tokens. Paste a token, see the header and payload, check whether it is expired, and copy any decoded section with one click. Everything runs locally in your browser — the token never leaves your machine.

The Problem

JSON Web Tokens are everywhere — OAuth, OpenID Connect, session cookies, service-to-service auth. When something goes wrong at 3am, you need to know three things: what algorithm signed this, what claims are inside, and is it expired.

The typical debugging loop looks like this: open a JWT decoder site, paste the token, mentally parse Unix timestamps, cross-reference the claims against the spec. If the tool you land on runs the decoding on a server, you have to think twice before pasting a production token into it. If it does not verify signatures, it should at least show the algorithm — plenty do not.

That friction is small on its own and huge over a year. The point of a debugger is to answer the question in seconds, not to become the next thing to think about.

How It Works

1. Paste, don't configure

Copy the raw JWT, an Authorization: Bearer <token> header, or even a URL that contains a token. The tool extracts the three dot-separated Base64URL segments automatically and starts decoding as you type.

2. Header, payload, and signature side-by-side

The header shows the signing algorithm and token type. The payload shows every claim in pretty-printed JSON. The signature is displayed as-is — signature verification requires the issuer's key and is intentionally out of scope for a decoder.

3. Human-readable timing claims

exp, iat, nbf, and auth_time are converted from Unix seconds to your local time zone with a relative label ("expires in 12 minutes", "issued 3 hours ago"). A colored badge tells you at a glance whether the token is valid, expired, or not yet active.

4. Standard claim descriptions

iss, sub, aud, jti, scope, nonce, amr — each standard claim gets a short description so you can spot missing or wrong values without opening the RFC.

5. One-click copy on every section

Grab just the header JSON, the payload JSON, or the raw signature. Toast confirms the copy. No selection fiddling.

Why 100% Client-Side Matters

JSON Web Tokens frequently contain sensitive claims: user IDs, email addresses, session identifiers, OAuth scopes, service account credentials. Pasting one into a web tool that decodes on a server means trusting that server not to log it.

JWT Debugger decodes locally — no fetch, no telemetry, no server round-trip. You can pop open DevTools, watch the Network tab, and confirm zero requests fire on decode. Even better, you can disconnect from the internet after the page loads and it still works.

That said: for production tokens that grant real access, the safest debugger is still your own backend and a JWT library that verifies the signature. This tool exists for the 90% of cases where you just need to see what is inside a token during development or a live incident.

Under the Hood

• Next.js 16 with the App Router
• TypeScript in strict mode
• Tailwind CSS v4 with OKLCH color tokens
• shadcn/ui + Radix for accessible primitives
• framer-motion for the entrance animations
• Pure client-side Base64URL + JSON parsing — zero dependencies beyond the browser
• Live claim table refreshes every second so relative timing labels stay honest
• Deployed on Vercel via GitHub Actions and served from jwt-debugger.tools.jagodana.com

Who Is This For

• Backend engineers debugging why an API call returns 401
• Frontend engineers confirming their auth library is sending the right claims
• SRE and platform teams inspecting service-to-service tokens during an incident
• Security engineers doing a quick sanity check on alg values in the wild
• Anyone who has ever seen eyJhbGciOi… and needed to know what was inside

Try It

→ jwt-debugger.tools.jagodana.com

Free forever, no login, no tracking of your tokens. Source is on GitHub if you want to audit it or run it yourself.