Decode and verify a JWT locally (no server, no leaking secrets)

Your token just failed and you cannot see why

A login loop, a 401 on a fresh token, a session that dies too early — the only clue is a long eyJ... string pulled from localStorage. The quick fix is tempting: paste it into a random "JWT debugger" website. But that means sending a live session token to someone else's server. Don't.

Decode it on your own machine

Open the JWT Decoder and paste the token. The header, payload, and signature segments split instantly. The header shows the algorithm (alg); the payload shows sub, exp, iss, and any custom claims. Because everything runs in your browser, the token never leaves your device.

Decoding is not verifying

This is the trap. The payload is just base64url — anyone can reverse it, which is exactly why a decoded payload proves nothing about identity. When you need to understand why the token looks the way it does, the Base64 Encoder / Decoder shows you the raw bytes behind each segment. Use that to confirm what is being encoded, then validate the signature against your app's secret on the server.

When to reach for this

• Debugging a login loop and confirming exp has not already passed.
• Comparing two tokens side by side to spot a claim mismatch.
• Checking which iss or aud your backend actually expects.

It is the fastest way to answer "what is actually inside this token" without writing a line of code — and without ever uploading it.