JWT Debugger
Decode and verify JSON Web Tokens. Inspect header, payload, signature; verify HS-signed tokens with a pasted secret.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Jane Doe",
"iat": 1716239022
}About the JWT Debugger
A JSON Web Token is three base64url strings joined by dots, and none of them are readable until you decode them. This JWT Debugger splits a pasted token into its header, payload, and signature, then shows each one decoded and pretty printed. Paste a token from an Authorization header, a cookie, or a log line, and you can read the algorithm, the claims, and when it was issued and expires.
Paste a token into the Token box and it decodes as you type. The header and payload are base64url decoded and reformatted as indented JSON, and the header panel labels the signing algorithm from the alg field. Any iat or exp claim is converted from Unix seconds to your local time, and a past exp shows an EXPIRED badge. To check the signature, type your HMAC secret and click Verify.
It decodes and verifies the token in the page itself, so no account is needed and the token never leaves your browser. Decoding and verification both run in your browser: the base64url decode happens in JavaScript, and verification loads the jose library on the client, so your token and secret never reach a server. That matters because a JWT often carries a live session or access grant. You can inspect production tokens without shipping them somewhere you cannot see.
How to use the JWT Debugger
- 1Paste your token into the Token box, replacing the sample that loads by default.
- 2Read the Header panel to confirm the alg and typ in the label.
- 3Read the Payload panel for the claims, and watch for the red EXPIRED badge.
- 4Check the issued and expires timestamps below the payload, shown in your local time.
- 5For an HS token, type your HMAC secret into the field under Verify signature (HS only).
- 6Click Verify and read the result: green for a valid signature, red for a failure.
What you can use it for
Debug a 401 response
Your API keeps returning 401 and you suspect the token. Paste it here and check the exp timestamp against the current time. The EXPIRED badge tells you at a glance whether the token lapsed rather than being malformed.
Confirm a shared secret
Two services sign HS256 tokens and one rejects the other's. Paste a token, enter the secret you configured, and click Verify. A red mismatch means the secrets differ; green confirms they match.
Inspect claims during handoff
A partner sends you an access token and you need to know what scopes or roles it carries before wiring it up. Decode it to read the payload claims as formatted JSON.
How HS signature verification works
An HS256 token is signed by running HMAC-SHA256 over the header and payload segments with a secret key, then base64url encoding the result as the third segment. To verify, this tool encodes your secret as UTF-8 bytes and asks jose to recompute the HMAC over the same header and payload. If the recomputed signature matches the one in the token, the signature is valid and you see the green result.
This is why the secret must be exactly right. HMAC is deterministic, so one wrong character produces a different signature and the check fails. It also explains the HS only limit: RS and ES tokens are signed with a private key and verified with a matching public key, so a shared secret cannot verify them.
Frequently asked questions
Is my token sent to a server?
No. Decoding runs entirely in your browser, and signature verification loads the jose library on the client, so the token and your secret stay on your machine. Nothing is uploaded, so you can safely paste a live session or access token.
Which algorithms can it verify?
Verification works for the HS family, such as HS256, HS384, and HS512, which use a shared HMAC secret. If you click Verify on an RS or ES token, the tool tells you it verifies HS algorithms and names the token's actual algorithm instead of giving a false result.
Can it still decode RS256 tokens?
Yes. Decoding does not depend on the algorithm, so an RS256 or ES256 token still shows its header, payload, and signature fully decoded. Only the verification step is limited to HS tokens, since an asymmetric signature needs a public key rather than a shared secret.
Does it check whether the token is expired?
It reads the exp claim, converts it to your local time, and shows an EXPIRED badge when that time is in the past. This is a check on the decoded claim, not part of verification, so a valid signature and an expired token are reported separately.
What if I paste something that is not a valid token?
The tool splits on dots and needs at least two parts, a header and a payload, before it shows anything. If a segment is not valid base64url or the decoded text is not JSON, that panel shows a dash or the raw text instead of crashing.