JWT Debugger

Decode and verify JWT tokens or encode new ones with various cryptographic algorithms. A comprehensive tool for working with JSON Web Tokens.

Security Note: All operations happen in your browser. Tokens and keys are never sent to the server.
JWT Token
Header
Payload (Claims)
Signature Verification
JWT Information

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

Supported Algorithms:
  • HMAC: HS256, HS384, HS512 (symmetric, uses secret key)
  • RSA: RS256, RS384, RS512 (asymmetric, uses private/public key)
  • RSA-PSS: PS256, PS384, PS512 (asymmetric)
  • ECDSA: ES256, ES384, ES512 (asymmetric)
  • EdDSA: Ed25519, Ed448 (asymmetric)
  • None: No signature (testing only)
Important Notes
  • JWTs should be transmitted only over secure connections (HTTPS) to prevent token interception.
  • Never store sensitive information in JWT payload as it can be decoded by anyone.
  • Keep your secret keys and private keys secure. Never expose them in client-side code or public repositories.
  • Implement proper token expiration (exp claim) and validation in your applications.

About JWT Debugger

Encode and decode JWT tokens with support for multiple algorithms including HMAC, RSA, ECDSA, and EdDSA

Decode a JWT into header and payload claims, inspect timestamps and metadata, and verify supported signatures with supplied key material.

Key features

  • What it examines Decode a JWT into header and payload claims, inspect timestamps and metadata, and verify supported signatures with supplied key material.
  • Analysis input Paste the complete compact token with its dot-separated segments; provide the correct shared secret or public key only when signature verification is required.
  • Signals and controls Inspect the declared alg, claim timestamps, issuer, audience, and available verification mode before trusting the result.
  • How to use the result The debugger displays decoded JSON and a signature-verification outcome without turning an unverified token into a trusted identity.

How to use JWT Debugger

Follow this workflow to work with JSON Web Tokens safely and accurately.

  1. Provide a sample or target Paste the complete compact token with its dot-separated segments; provide the correct shared secret or public key only when signature verification is required.
  2. Choose the relevant checks Inspect the declared alg, claim timestamps, issuer, audience, and available verification mode before trusting the result.
  3. Run the analysis Run the analysis on the JSON Web Tokens and distinguish direct observations from estimates or heuristic classifications.
  4. Interpret the findings The debugger displays decoded JSON and a signature-verification outcome without turning an unverified token into a trusted identity.

Usage tips

  • Decoding Base64URL segments requires no secret and does not prove the token is authentic.
  • Pin allowed algorithms in the receiving application instead of accepting the token header blindly.
  • Validate exp, nbf, iss, aud, nonce, and application-specific claims after verifying the signature.

Frequently asked questions

Decode a JWT into header and payload claims, inspect timestamps and metadata, and verify supported signatures with supplied key material.
Paste the complete compact token with its dot-separated segments; provide the correct shared secret or public key only when signature verification is required.
Inspect the declared alg, claim timestamps, issuer, audience, and available verification mode before trusting the result.
A token containing personal data or bearer credentials is sensitive. Do not paste production tokens into environments you do not control, and never treat decode-only output as verification.