JSON Web Tokens (JWTs) are the standard authentication mechanism for modern web APIs. They consist of three Base64URL-encoded segments separated by dots: the header (algorithm and token type), the payload (claims — user ID, roles, expiration), and the signature (cryptographic verification). Debugging JWT issues — expired tokens, missing claims, wrong algorithms, malformed payloads — requires decoding the token to inspect its contents. The Utility Spark JWT Decoder splits a JWT into its components, decodes the Base64URL payload, and displays the claims in a readable format with timestamps converted to human-readable dates. Importantly, this tool runs entirely in your browser. JWTs contain sensitive authentication data (user IDs, roles, session information). Pasting a production JWT into a server-based decoder sends your authentication credentials to a third party.
lightbulb When to use this tool
- check_circle Debug authentication issues by inspecting JWT payload claims (sub, iat, exp, aud)
- check_circle Verify token expiration time without writing code
- check_circle Check which algorithm (HS256, RS256, ES256) a JWT uses
- check_circle Inspect custom claims added by your authentication provider
- check_circle Debug OAuth2 and OpenID Connect token exchanges
- check_circle Verify token structure before sending in API requests
Why use our tool?
Instant Token Decoding
Paste a JWT and instantly see the decoded header, payload, and signature. Each section is formatted and syntax-highlighted for easy reading. No need to manually Base64-decode individual segments.
Human-Readable Timestamps
JWT timestamps (iat, exp, nbf) are Unix epoch seconds — meaningless at a glance. The decoder converts these to human-readable dates and shows whether the token is currently valid, expired, or not-yet-valid.
Algorithm Identification
Immediately see which signing algorithm the token uses (HS256, RS256, ES256, etc.). This is critical for debugging signature verification failures, which are often caused by algorithm mismatches between token issuer and verifier.
Privacy-Safe Decoding
JWTs contain authentication credentials. The decoder runs entirely in your browser — your tokens are never transmitted to any server. This makes it safe to decode production tokens without compromising security.
Claim Validation Hints
The tool highlights common issues: expired tokens, missing required claims (iss, sub, exp), and unusual or non-standard claims. This accelerates debugging when API calls fail with 401 or 403 errors.
How it works
Paste your full JWT token (the three-part string beginning with eyJ...) into the input field.
The tool immediately splits the token and displays decoded JSON for the Header and Payload sections.
Review the Header for the algorithm (alg) and token type (typ).
Review the Payload for all claims: sub, iss, aud, exp, iat, nbf, and any application-specific custom claims.
Check the expiry (exp) field — it is displayed as both the raw Unix timestamp and a human-readable datetime.
Examples
science Debugging a 401 — Checking Token Claims
Token header (decoded): {"alg": "HS256", "typ": "JWT"}
Token payload (decoded): {"sub": "user_123", "roles": ["viewer"], "exp": 1690000000, "iat": 1689914000}
Human-readable exp: Expired: 2023-07-22 14:33 UTC
Debug finding: Token expired 12 hours ago — this is the cause of the 401.
science Checking Algorithm for Security Review
Header: {"alg": "none", "typ": "JWT"}
Security flag: alg: none is a critical vulnerability — it means the token has no cryptographic signature and cannot be trusted. A backend that accepts alg:none tokens is vulnerable to token forgery. This is a real vulnerability class (CVE-2015-9235) that the tool surfaces immediately.