Find out what a token says, and why it’s refused
Paste a JSON Web Token, or whatever holds one, and read it in a sentence: what kind of token it is, who issued it, who it’s for, how it’s signed and whether it has expired. Every claim is explained, times appear in UTC and your own time zone, and anything unusual is pointed out. When a token is refused, compare it with one that works to see the likely reasons.
Token questions this answers
Read a pasted Authorization header
Input
Authorization: Bearer eyJhbGciOiJSUzI1NiIs…
Result
An access token from login.example.com for api://orders, issued to Avery Example, signed with RS256. Valid for another 55 minutes.
The token is found inside the header. A token that still works is flagged: treat it like a password, because anyone holding it can use it.
Why one token is refused
Input
This token: aud api://billing, key example-key-2025 Token that works: aud api://orders, key example-key-2026
Result
It isn’t meant for api://orders. Signed with a different key.
Turn on Compare with a token that works. The likely reasons come first; claims that differ in every token, such as iat and jti, are set aside.
Spot a near miss
Input
Expected issuer: https://login.example.com Token issuer: https://login.example.com/
Result
They differ only by a trailing slash.
Issuers and audiences are compared exactly, as APIs compare them, and a near miss is named.
How to read and debug a token
- Paste a token, or text that holds one: a header, a cURL command, a cookie, a JSON response or a log line. When there are several, choose which to read.
- Read the answer at the top, then the timing, each claim with what it means, and anything worth a look. The Payload and Header tabs hold the decoded JSON.
- In the settings, add the issuer and audience your API expects, a time to check at, or a clock tolerance.
- To see why a token is refused, turn on Compare with a token that works and paste one the API accepts. Copy summary describes the result for a ticket without the token or its values.
JWT decoder questions
Is my token sent anywhere?
No. It is decoded in your browser and never uploaded, stored or put in the page address. A token that hasn’t expired still works, so treat it like a password.
Does this check the signature?
No. Anyone can write a token that reads well, so readable claims don’t prove a token is genuine. Every token is marked Signature not checked; checking needs the issuer’s key, which an API does itself.
Which tokens can it read?
Signed JWTs, in three parts, and the header of encrypted ones, in five. It explains standard and OpenID Connect claims and recognizes tokens from Microsoft Entra ID, Auth0, Okta, Amazon Cognito, Google, Firebase, Keycloak and others by their issuer.
What does comparing with a working token show?
The differences most likely to explain a refusal, in order: expiry, issuer, audience, algorithm, signing key, tenant, app, version and missing scopes or roles. Claims that differ in every token are listed apart, and every claim can be seen side by side.
What is in the copied summary?
Which checks ran and how they came out, the timing, the kinds of difference found and the claim names. It never includes the token, the signature or any claim value. Read it before you share it.
Decoding is not verifying
This tool reads tokens; it doesn’t sign, verify or decrypt them, and it never visits a key address named in a token. Times are seconds since 1970. Provider names are a best guess from the issuer. An API’s own rules, such as required scopes, can still refuse a token that looks right here.