Three parts, two dots
A JWT looks like header.payload.signature. Each part is base64url-encoded. The header names the algorithm and type, the payload carries the claims (data), and the signature proves it hasn't been tampered with.
🔐 Developer Tools
JWT Debugger
Paste a JSON Web Token to instantly decode its header and payload, read claims and expiry, and verify the signature — all privately in your browser. Your token and secret never leave your device.
🔗 Encoded token
The color-coded token will appear here…
HEADER · algorithm & token type
—
PAYLOAD · data / claims
—
📋 Registered claims
| Claim | Meaning | Value |
|---|
✅ Verify signature alg: —
Status:
Enter a secret or public key to verify
For RSA/ECDSA tokens (RS/PS/ES), paste a PEM public key instead of a secret.
Instant decoding
See the header and payload as pretty-printed JSON the moment you paste a token.
Claims & expiry
Timestamps like iat, nbf, and exp are converted to readable dates with a clear expired/valid badge.
Signature verification
Validate HS, RS, PS, and ES signatures with a secret or PEM public key using the Web Crypto API.
Private by design
Everything runs in your browser. Your token and secret are never sent anywhere.
Anatomy of a JWT
Encoded ≠ encrypted
The header and payload are only encoded, not encrypted — anyone can decode and read them. Never put passwords or secrets in a payload. The signature is what stops attackers from changing the claims.
How it works
Paste a token and ToolAdda splits it on the dots, base64url-decodes the header and payload, and pretty-prints the JSON. To verify, it re-computes the signature with your secret or public key using the browser's built-in Web Crypto API and compares it to the token's signature.
Privacy notice
Decoding and verification happen 100% locally in your browser. Your JWT, secret, and keys are never uploaded, logged, or stored on any server.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, URL-safe token of three base64url parts — header, payload, and signature — used widely for authentication and sharing claims between services.
Is it safe to paste my token?
Yes. All decoding and verification run in your browser with the Web Crypto API. Nothing is sent to a server.
How do I verify the signature?
Enter the shared secret for HS256/384/512, or paste a PEM public key for RS, PS, and ES tokens. The status shows whether the signature is valid.
Why can everyone read my payload?
The payload is only base64url-encoded, not encrypted. Never store sensitive data in it; the signature only guarantees integrity, not confidentiality.
What does the expiry badge mean?
If the token has an exp claim, the tool converts it to a readable date and shows whether the token is still valid or already expired.
Which algorithms are supported for verification?
HS256/384/512 (HMAC), RS256/384/512 and PS256/384/512 (RSA), and ES256/384 (ECDSA).
Free online JWT debugger and decoder
The JWT Debugger by ToolAdda helps developers inspect JSON Web Tokens quickly and safely. Decode the header and payload, check when a token was issued and when it expires, and verify its signature against a secret or public key — without installing anything or sending your token to a server. It's a handy companion when building or debugging authentication, APIs, and single sign-on flows.
How to use
- Paste your JWT into the token box.
- Review the decoded header, payload, and claims.
- Enter a secret or public key to verify the signature.
Benefits
- Instant, readable decoding with expiry checks.
- Signature verification for common algorithms.
- Completely private and free — no sign-up.