JWT Decoder & Debugger Studio
100% Local Browser ProcessingDeveloper SuiteExpiration Date (exp): Fri, 31 Jul 2026 02:50:00 GMT
Issued At Date (iat): Thu, 31 Jul 2025 08:12:27 GMT
How to Decode & Debug JSON Web Tokens (JWT)
Inspect Header, Payload claims, expiration timestamps, and verify HMAC signatures 100% locally inside browser memory.
Paste Raw JWT Token
Paste any JSON Web Token (JWT) string into the left editor pane or click 'Try Sample' to load Auth0, Firebase, or Supabase test tokens.
Real-Time Parsing & Validation
Meema Tools automatically parses the Header JSON, Payload claims, expiration status (exp claim), and calculates human-readable dates.
Verify Signature or Copy
Enter your HMAC secret key to verify token authenticity or copy individual claims, formatted Header/Payload JSON, or generated tokens.
Standard Registered JWT Claims Reference Rules
Understand standard claims defined by RFC 7519, their data types, and typical security usages in authentication tokens.
| Claim Key | Data Type | Sample Value | Claim Specification Description |
|---|---|---|---|
| sub (Subject) | String / UUID | "1234567890" | Identifies the principal subject of the JWT (e.g. User ID, Account GUID). |
| exp (Expiration) | Numeric Date (s) | 1785466200 | Unix timestamp after which the JWT must NOT be accepted for processing. |
| iat (Issued At) | Numeric Date (s) | 1753949547 | Unix timestamp identifying the time at which the JWT was issued. |
| nbf (Not Before) | Numeric Date (s) | 1753949547 | Unix timestamp before which the JWT must NOT be accepted for processing. |
| iss (Issuer) | String / URL | "https://auth.meema.in/" | Identifies the principal authority that issued the JWT authentication token. |
| aud (Audience) | String / Array | "https://api.meema.in/v1" | Identifies the intended recipient or target API audience of the token. |
Why Use Meema Tools JWT Studio?
Built for maximum developer debugging speed, RFC 7519 compliance, HMAC signature verification, and 100% client-side security.
Color-Coded JWT Inspector
Instantly parse raw JWT strings into distinct color-coded Header, Payload, and Signature components.
Claim Expiration Auto-Status
Auto-detects exp, iat, and nbf claims with active or expired status badges and human-readable dates.
Signature Verification
Verify HMAC-SHA256 signatures client-side to ensure token authenticity and secret key accuracy.
JWT Encoder & Presets
Build custom signed JWTs from Header & Payload JSON or test with Auth0, Firebase, and Supabase presets.
Frequently Asked Questions
About JSON Web Tokens
Everything you need to know about JWT decoding, claims, signature verification, and browser security.
100% Confidentiality
All JWT decoding & signature verifications run locally on your computer. Zero secret keys or tokens touch any external server.
A JSON Web Token (JWT) is a compact, URL-safe standard (RFC 7519) for securely transmitting claims between two parties. A JWT consists of three Base64URL-encoded parts separated by dots: Header, Payload (Claims), and Signature.
No! 100% of JWT decoding, JSON parsing, and HMAC-SHA256 signature verification occur locally inside your web browser. Your auth tokens, secret keys, and user claims never leave your device.
The exp (expiration time) claim in a JWT payload represents a Unix timestamp in seconds. Meema Tools automatically parses the exp, iat (issued at), and nbf (not before) claims, displaying an active (🟢) or expired (🔴) badge with human-readable date & time.
Yes! Enter your secret key in the Signature Verifier tab. The tool computes the HMAC-SHA256 signature using browser Web Crypto APIs and compares it against the token's signature, confirming whether the token is authentic or modified.
Explore Related Developer Tools
Fast, private document & code utilities running locally in your browser
Base64 Encoder & Decoder
Encode & decode text, images, and files to Base64 Data URIs or decode raw strings.
Hash Generator & Checksum Tool
Generate SHA-256, SHA-512, MD5 hashes and calculate file integrity checksums.
JSON Formatter & Beautifier
Format, beautify, validate, and minify raw JSON data with real-time error checking.