Skip to main content
SECURITY & CRYPTO·Client-Side (100% Private)

JWT Decoder, Debugger & Token Generator

Decode, inspect, verify, and generate JSON Web Tokens (JWT). Edit claims, simulate expiration times, and sign HS256/HS384/HS512 tokens client-side.

Initializing JWT Decoder, Debugger & Token Generator...
✓

Zero Server Storage Guarantee

Data entered into this tool is processed 100% locally within your browser. Nothing is ever sent to or logged on any server.

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions about JWT Decoder, Debugger & Token Generator

Quick answers to common questions about usage, conversion rules, privacy guarantees, and best practices.

What are the three parts of a JSON Web Token (JWT)?

A standard JWT consists of three parts separated by dots (Header.Payload.Signature). The Header specifies the algorithm and token type, the Payload contains user claims and metadata, and the Signature verifies that the message was not altered in transit.

Can anyone read the payload of an unencrypted JWT?

Yes. Unless the token is encrypted with JWE (JSON Web Encryption), the payload is simply Base64URL-encoded and can be inspected by anyone who has access to the token string.

How do I verify the expiration time (exp) and issued-at (iat) timestamps of a JWT?

JWT timestamps are stored as standard Unix epoch seconds. The debugger parses "exp", "nbf", and "iat" claims into human-readable local time and UTC formats, indicating whether a token is active, expired, or not yet valid.