How to Decode JWT Headers, Claims, and Expiry Locally
Debugging 401 Unauthorized responses requires inspecting `aud`, `iss`, `scope`, and `exp` claims without leaking bearer tokens to external logging endpoints.
Free Tool
JWT & Auth Token Studio
No account required · Free forever
Step-by-Step Guide
- 1
Paste the encoded JWT string
Header and payload segments decode immediately from Base64URL in browser memory.
- 2
Check expiration and clock skew
Review formatted UTC/local dates for exp, iat, and nbf claims.
- 3
Verify HMAC signature (optional)
Provide your local test secret to confirm HS256, HS384, or HS512 integrity via SubtleCrypto.
Who This Is For
API & Security Engineers
Diagnosing OAuth 2.0 / OIDC claim mismatches without external traffic.
Frequently Asked Questions
Can anyone decode a JWT payload without the secret key?
Yes. Standard JWS tokens are Base64URL-encoded, not encrypted—the secret key verifies authenticity rather than hiding claims.