A standard JWT consists of three parts separated by dots (Header.Payload.Signature). The Header specifies the algorithm and token type, the Payload contains user claims and metadata, and the Signature verifies that the message was not altered in transit.
JWT Decoder, Debugger & Token Generator
Decode, inspect, verify, and generate JSON Web Tokens (JWT). Edit claims, simulate expiration times, and sign HS256/HS384/HS512 tokens client-side.
Zero Server Storage Guarantee
Data entered into this tool is processed 100% locally within your browser. Nothing is ever sent to or logged on any server.
Frequently Asked Questions about JWT Decoder, Debugger & Token Generator
Quick answers to common questions about usage, conversion rules, privacy guarantees, and best practices.
What are the three parts of a JSON Web Token (JWT)?
Can anyone read the payload of an unencrypted JWT?
Yes. Unless the token is encrypted with JWE (JSON Web Encryption), the payload is simply Base64URL-encoded and can be inspected by anyone who has access to the token string.
How do I verify the expiration time (exp) and issued-at (iat) timestamps of a JWT?
JWT timestamps are stored as standard Unix epoch seconds. The debugger parses "exp", "nbf", and "iat" claims into human-readable local time and UTC formats, indicating whether a token is active, expired, or not yet valid.
More from Security & Crypto
Hash Generator & Checksum Calculator
Generate instant SHA-256, SHA-512, SHA-3, SHA-384, SHA-224, SHA-1, RIPEMD-160, MD5, and CRC32 hashes from text or files with live checksum matching computed 100% locally.
UUID, ULID & NanoID Generator
Generate and inspect cryptographically random UUID v4, time-sortable UUID v7, ULID, NanoID, and Snowflake identifiers in bulk.
GUID Generator (.NET & C# Unique Identifier)
Generate Microsoft Globally Unique Identifiers (GUIDs) in Registry format, C# syntax, T-SQL literals, and uppercase hex in bulk.