JWT Debugger
Decode and inspect JWT tokens — view header, payload, expiration, issuer, subject, and other standard claims. Paste an HMAC secret to genuinely verify HS256/384/512 signatures — local inspection, free, no signup.
How to Use the JWT Debugger
Similar Tools You Might Need
See allBase64 to JSON Decoder
Decode Base64 strings and pretty-print JSON data — paste encoded text to see the decoded result instantly. Inspect API payloads and tokens readably — free, local, no signup.
JWT Inspector
Decode JWT headers and payloads instantly — inspect claims, expiry, and algorithm before trusting a token. Debug auth failures in seconds — local processing, free, no signup.
SSL Certificate Decoder
Decode and view SSL certificate details including subject, issuer, and validity period. Code never leaves your device — formatting and validation run locally in your browser.
Email Signature Generator
Build professional HTML email signatures with photo, links, and contact details. Sign every mail like a company — local generation, free, copy-paste.
Hindi / Regional Font Generator
Decorate Hindi, Tamil, Telugu, Bengali, Marathi, Gujarati, and other Indian regional text with symbol borders, plus Unicode styling for English names. Copy-paste styled text for social media, WhatsApp, and more.
Frequently Asked Questions
What JWT fields are displayed?
Header (algorithm, type), payload (all claims), and signature. Standard claims like exp, iss, sub, aud, iat, and jti are decoded and displayed with human-readable labels.
Does it verify token signatures?
Yes for HMAC: paste the signing secret and HS256/384/512 signatures are recomputed via WebCrypto and compared — match or mismatch reported. RS/ES need public keys this tool doesn't collect, so those stay unverified, never valid.
Can I check if a token is expired?
Yes. The 'exp' claim is decoded to a human-readable timestamp, and the tool shows whether the token is currently valid or expired.
Does it support all JWT algorithms?
It decodes headers for any algorithm (HS256, RS256, ES256, etc.). However, it only displays the content — it does not perform signature verification for any algorithm.
Is my token data uploaded?
No. All decoding happens locally in your browser. No JWT data is sent to any server.
What can the Encode / Sign tab do?
HMAC signing only: HS256 maps to SHA-256, HS384 to SHA-384 and HS512 to SHA-512 via Web Crypto. An empty secret blocks with Enter a secret to sign with, non-object JSON blocks, and the selected algorithm overwrites any alg in your header JSON. Encoding works in 0x8000-character chunks.
Related Developer Tools
JWT Inspector
Decode JWT headers and payloads instantly — inspect claims, expiry, and algorithm before trusting a token. Debug auth failures in seconds — local processing, free, no signup.
JWT Encoder & Signer
Build and sign JWTs with HS256/RS256 — headers, claims, expiry, and signature verification. Mint test tokens without backend roundtrips — local crypto, free, no signup.
Last updated October 2026