JWT decoder: read a token's header, payload and expiry in your browser

A JWT decoder turns the three dot-separated parts of a JSON Web Token back into readable JSON, so you can see who the token is for, what it allows and when it runs out. The AyeTab JWT Debugger does that for free in your browser, and the token you paste stays on your device.

What is inside a JWT

A signed JWT looks like a long random string, but it has a fixed shape: header.payload.signature. Each part is Base64-URL encoded, which is an encoding, not encryption. Anyone holding the token can read the first two parts.

• Header. A small JSON object that names the signing algorithm (alg, for example HS256 or RS256) and usually the type (typ: JWT).
• Payload. The claims: the subject (sub), issuer (iss), audience (aud), expiry (exp), issue time (iat) and whatever custom fields your auth server adds, such as roles or a tenant ID.
• Signature. A value computed from the header, the payload and a key. It proves the token was not changed, but only a party with the right key can check it.

Decoding is the part you need most days. When a request fails with a 401, the answer is often sitting in the payload: the token expired an hour ago, the audience points at the staging API, or a role claim is missing.

How the AyeTab JWT Debugger shows a token

Open the tool and paste the token into the box. The output updates as you type, split into three cards:

That expiry chip saves the usual detour of copying a Unix timestamp into a separate converter. If the string does not have three parts, the tool says so in plain words ("Invalid JWT: expected 3 dot-separated parts"), which catches the common mistake of pasting Bearer along with the token or cutting off the end.

The tool reads tokens. It does not ask for a secret or a public key, so it does not verify signatures, and it does not create new tokens.

Why decoding locally matters

A JWT is a credential. If you paste a live production token into a website, the text can reach that site's server, and from there you cannot see what happens to it. jwt.io's own introduction says tokens should not be kept longer than needed, and the same thinking applies to where you paste them.

AyeTab decodes the token inside the browser tab. Nothing is uploaded to AyeTab's servers, there is no account to create, and the page keeps working offline once it has loaded. That makes it a sensible default for tokens from real users.

Two ways to open it

AyeTab comes as a web app and as a free Chrome extension with the same tools:

• Web app. Go to app.ayetab.com in Chrome, Firefox, Edge or Safari. No install.
• Extension. It replaces your new tab page with the tool list and adds a side panel, so the decoder is one tab away while you watch network requests.

In the extension, smart paste helps: paste a JWT on the new tab and AyeTab suggests the decoder. Ctrl+K (Cmd+K on a Mac) opens a command palette to jump to any tool, and you can star the ones you use most. The Base64 decoder, JSON formatter and Unix time converter sit next to it for the jobs around token debugging.

When to use something else

If you need to check a signature against a secret or a public key, or build a test token, use a tool that does that, such as the debugger on jwt.io or your auth library's own functions. For reading claims and expiry, the AyeTab decoder is the quicker and more private choice.