Three-part compact token
header.payload.signature
The header and payload can be decoded; neither is trustworthy until verification succeeds.
JWT Debugger
Paste a JWT below to decode its header and payload entirely in your browser. The token is never sent to a server, never added to the URL, and never persisted — reload the page and it's gone.
JWT debugging examples
Start with the token shape, then separate readable claims from cryptographic trust.
Expiration claim
{"exp": 4102444800}The Unix timestamp describes a validity boundary, not proof that the issuer signed it.
Common mistakes
- Treating Base64URL decoding as verification.
- Accepting an algorithm selected by untrusted token input.
- Logging or sharing a production bearer token.
Examples and guidance reviewed .
