Debugging authentication flows is one of the most tedious tasks in backend and full-stack development. A user cannot log in. A protected API route keeps returning 401. A refresh token flow is breaking. In most of these cases, the root cause is visible in the JWT token itself — but only if you can read it. JWT tokens are three Base64url-encoded segments separated by dots. Without decoding them, they are opaque strings. The Utility Spark JWT Decoder splits the token into its three components, decodes each section, and displays the parsed JSON for the header and payload in a readable, formatted view. You immediately see the algorithm (HS256, RS256, etc.), the subject (sub), the issued-at time (iat), the expiration (exp) in human-readable date format, and any custom claims your application adds. This all happens in your browser — the token is decoded via JavaScript's atob() function locally, with no server involved. JWT tokens can contain personally identifiable information, user roles, session data, and authentication state. Sending them to a public server-side debugging tool is a security risk. This tool eliminates that risk entirely.
lightbulb When to use this tool
- check_circle Debugging a 401 Unauthorized error by inspecting the JWT payload to check user roles, permissions, or required claims.
- check_circle Checking whether a JWT token has expired by reading the exp (expiration) timestamp in human-readable format.
- check_circle Verifying the algorithm in the header (alg field) matches what your backend expects (HS256, RS256, etc.).
- check_circle Inspecting custom application claims in the payload during development to confirm they are populated correctly.
- check_circle Reading the sub (subject), iss (issuer), and aud (audience) claims to debug token validation failures.
Why use our tool?
Three-Section Breakdown — Header, Payload, Signature Status
The tool splits the JWT at its dot separators and decodes each section independently. Header reveals the algorithm and token type. Payload shows all claims in formatted JSON with epoch timestamps converted to human-readable dates. Signature is noted as present but not verifiable client-side (signature verification requires the secret key, which belongs on your backend).
Epoch Timestamps Converted to Readable Dates
JWT timestamps (iat, exp, nbf) are stored as Unix epoch seconds — a number like 1690000000 that tells you nothing at a glance. The tool automatically converts these to readable local datetime strings so you can immediately see 'Expires: 2024-07-22 14:30:00' rather than doing mental arithmetic on a Unix timestamp.
Your Token Never Leaves Your Browser
JWT.io — the most widely used JWT debugging tool — is hosted on Auth0's servers and processes your token through their infrastructure. For tokens containing user PII, session identifiers, or authentication state, this is a meaningful privacy consideration. This tool decodes JWTs client-side using JavaScript's atob() function. Your token never makes a network request.
Instant — No Submit Button Required
Paste a JWT and the decoded output appears immediately — no button click, no page transition. As you edit the token in the input field, the decoded view updates in real time. Useful when comparing multiple token variants during debugging.
Clear Invalid Token Error Handling
Pasting a malformed token, a non-JWT Base64 string, or a token with incorrect section count produces a clear, specific error message identifying the problem (wrong number of segments, invalid Base64, non-JSON payload) rather than a generic failure.
How it works
Paste your full JWT token (the three-part string beginning with eyJ...) into the input field.
The tool immediately splits the token and displays decoded JSON for the Header and Payload sections.
Review the Header for the algorithm (alg) and token type (typ).
Review the Payload for all claims: sub, iss, aud, exp, iat, nbf, and any application-specific custom claims.
Check the expiry (exp) field — it is displayed as both the raw Unix timestamp and a human-readable datetime.
Examples
science Debugging a 401 — Checking Token Claims
Token header (decoded): {"alg": "HS256", "typ": "JWT"}
Token payload (decoded): {"sub": "user_123", "roles": ["viewer"], "exp": 1690000000, "iat": 1689914000}
Human-readable exp: Expired: 2023-07-22 14:33 UTC
Debug finding: Token expired 12 hours ago — this is the cause of the 401.
science Checking Algorithm for Security Review
Header: {"alg": "none", "typ": "JWT"}
Security flag: alg: none is a critical vulnerability — it means the token has no cryptographic signature and cannot be trusted. A backend that accepts alg:none tokens is vulnerable to token forgery. This is a real vulnerability class (CVE-2015-9235) that the tool surfaces immediately.