JWT decoder and debugger

A JSON Web Token is a compact way to pass signed information, most often who a user is and what they may do. It has three parts separated by dots: a header that names the algorithm, a payload of claims such as the user’s ID and when the token expires, and a signature that proves who issued it and that nothing was changed.

Paste it into the box above. The header and payload are base64url-encoded JSON, so decoding them needs no key. You can paste the token on its own, or the Authorization header, cURL command, cookie, JSON response or URL it came in, and the decoder finds it.

The token is decoded in your browser and never sent anywhere: not to Faylee, not to a proxy, and not into the page address, analytics or storage. The only requests the page makes are the key lookups you ask for, from your own browser. Still, a token that hasn’t expired works for anyone who has it, so treat it like a password and prefer expired or test tokens when you can.

Yes. Anyone who has a token can read its header and payload, because they are only encoded, not encrypted. The secret or key is needed to check the signature, not to read the token. That is why a JWT must never hold a password, an API key or anything else secret.

Decoding reads what the token says. Verifying checks the signature with the secret or public key, which proves the token was issued by whoever holds that key and wasn’t changed since. A server must verify a token before trusting anything in it.

Its exp time has passed. If that seems wrong, check three things: whether the clocks of the server that made it and the one checking it agree, whether exp was written in milliseconds instead of seconds, and whether your app refreshes tokens before they run out. Access tokens often last only 5 to 60 minutes.

iss is the issuer, who made the token. sub is the subject, usually the user’s ID. aud is the audience, who the token is for. exp is when it expires, nbf the time before which it isn’t valid, and iat when it was issued. All three times are seconds since January 1, 1970, UTC. The decoder explains each claim next to its value.

A JWE has five parts instead of three, and its payload is encrypted, so only its header can be read without the key. The decoder shows that header. To read the rest you need the private key, which belongs on the server that receives the token.

This decoder reads one token you paste. Faylee records a bug the way someone hit it, with the video, console and every network request with its headers, hides tokens before anything is uploaded, and shares it all as one link your team or coding agent can open.