100% Client-Side Privacy
All decoding and Web Crypto HMAC-SHA256 signature calculations run entirely in your local browser sandbox. No secret keys or bearer tokens ever touch a network.
JWT Debugger & Decoder
Free online JWT Debugger and Decoder. Inspect JWT headers, payloads, claims, and expiration timestamps with client-side privacy and HMAC-SHA256 verification.
Demo Tokens:
Valid JWT Structure (3 parts)Expires in 60 days
alg: HS256Enter secret below to verify
Encoded Token String288 chars
Header: Algorithm & Token Type
{
"alg": "HS256",
"typ": "JWT"
}Payload: Data Claims & Timestamps
{
"sub": "user_123456",
"name": "Alex Morphey",
"email": "[email protected]",
"roles": [
"user",
"developer"
],
"iat": 1704111200,
"exp": 1798761600,
"iss": "usefulgo.com"
}exp (Expires):Jan 1, 2027, 12:00:00 AM
iat (Issued At):Jan 1, 2024, 12:13:20 PM
SignatureHMACSHA256(base64Url(header) + "." + base64Url(payload), secret)
TZTJtwEzoFzvrWNggnqWzTrf6CbO9ToQDDXc2DADU3E
Developer Scenario: Diagnosing Token Expiration and Role Mismatch in OAuth2 / OIDC
A backend engineer investigates why API calls return 401 Unauthorized by decoding the user session bearer token and discovering the token expired 10 minutes ago.
| Encoded JWT | eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsZXggRGV2IiwiaWF0IjoxNTE2MjM5MDIyfQ.XbPfbIHMI6arZ3Y922BhjWgQzWXcXNrz0ogtVhfEd2o |
| Decoded Header | { "alg": "HS256", "typ": "JWT" } |
| Decoded Payload | { "sub": "1234567890", "name": "Alex Dev", "iat": 1516239022 } |
💡 The developer identifies that the token payload lacks the required admin role claim, enabling quick correction in the auth provider.
How to use JWT Debugger & Decoder
- 1
Paste your encoded JSON Web Token (JWT) into the input box to instantly decode its Header, Payload, and Signature.
- 2
Inspect decoded claims such as expiration time (exp), issued-at (iat), subject (sub), and custom roles with human-readable timestamps.
- 3
Optionally enter an HMAC-SHA256 secret key to test signature validity client-side, or switch to the Generator tab to mint custom tokens.
Why use this tool?
Human-Readable Timestamps & Expiration Alerts
Instantly view human dates, relative countdowns, and expiration warnings for exp, iat, and nbf claims.
Live Signature Verification & Token Generator
Verify HS256 signatures with custom secrets in real time, or generate fresh signed test tokens without leaving the page.
Frequently asked questions
Is it safe to paste confidential production JWT tokens into this tool?
Yes. UsefulGo processes your tokens 100% locally in your browser sandbox using the Web Crypto API. No tokens, secrets, or payloads are transmitted across any network or logged on external servers.
What are the three parts of a JSON Web Token?
A standard JWT consists of three base64url-encoded parts separated by periods (.): the Header (specifying the signing algorithm), the Payload (containing data claims and expiration timestamps), and the Signature (verifying message integrity).
Which signing algorithms are supported for signature verification?
The tool provides full real-time HMAC-SHA256 (HS256) signature verification and generation via Web Crypto API. For asymmetric tokens like RS256 or ES256, it decodes the payload and header without requiring the private key.
Related tools
Developer Tools
JSON Formatter & Validator
Format, beautify, validate, and minify JSON data online with instant syntax error highlighting and tree inspection.
Regex Tester & Debugger Online
Test, evaluate, and debug regular expressions in real-time with visual match highlights, capture group inspection, and quick regex cheat sheets.
Cronjob Explainer & Generator
Translate crontab schedule expressions into human-readable English, preview upcoming execution dates, and generate cron expressions interactively.
JSON Diff & Compare Online
Compare two JSON structures side-by-side with automatic key sorting, colored difference highlights, and change breakdown.
UUID / GUID Generator
Generate secure, cryptographically random Version 4 (v4) and time-ordered Version 7 (v7) UUIDs and GUIDs with custom formatting, bulk batch generation, and live inspection.
JSON Tree Viewer
Explore, navigate, and inspect complex JSON payloads with an interactive collapsible tree viewer, type badges, node search, and JSON path copying.