DevPouch
Favorites

No favorites yet

Text & Code
Markdown EditorHTML PreviewerText StatisticsString Case ConverterText Diff CheckerGit Command Helper
Data & Formatting
JSON FormatterJSON DiffXML ⇆ JSON ConverterYAML ⇆ JSON ConverterCSV to JSON Converter.env ⇆ JSON ConverterJSON to C# ClassesData ValidatorScreenshot to Data
Encoders & Decoders
Base64 Encoder/DecoderURL Encoder/DecoderHash GeneratorAES Encryption/Decryption
Generators
Password GeneratorGUID / UUID GeneratorQR Code GeneratorTest Data GeneratorLorem Ipsum Generator
Color & Design
Color ConverterColor Palette Generator
Image & Media
Image ResizerImage Format ConverterImage CropperImage RotatorImage CompressorImage WatermarkImage Metadata ViewerAI Image Pipeline
PDF Tools
PDF MergerPDF SplitterPDF CompressorPDF to ImagesImages to PDFPDF Text ExtractorPDF Watermark
Testing & Debug

JWT Debugger

Decode, verify, and sign JWT tokens with detailed inspection

Paste a JSON Web Token to decode its header and payload instantly and inspect every claim: issuer, subject, audience, expiry, and any custom fields. It's the fast way to debug authentication issues, confirm what a token actually contains, and check whether it has expired. A Generate & Sign tab is built in too, so you can also assemble a payload and sign it with an HMAC secret (HS256, HS384, or HS512) without leaving the page.

Runs 100% in your browser · no upload, no tracking, no ads

How to use JWT Debugger

  1. Paste your JWT into the input field.
  2. View the decoded header and payload as readable JSON.
  3. Inspect standard claims like exp, iat, iss, and aud.
  4. Optionally provide a secret to verify the signature.
  5. Switch to the Generate & Sign tab to build a token: enter a JSON payload, pick an HMAC algorithm and secret, then sign.

Frequently asked questions

Is it safe to paste a token here?

Decoding happens entirely in your browser and tokens are not transmitted. Still, treat production tokens carefully and avoid pasting long-lived secrets where you don't need to.

Can I verify the signature?

Yes, you can supply the signing secret or key to check that the signature is valid, which confirms the token hasn't been tampered with.

Why is my token's payload readable without a key?

A JWT's header and payload are Base64URL-encoded, not encrypted, so anyone can decode them. The signature is what guarantees integrity, not confidentiality.

Can I create and sign my own tokens?

Yes. The Generate & Sign tab assembles a header, base64url-encodes your JSON payload, and signs it with the HMAC family (HS256, HS384, or HS512) via the Web Crypto API. Asymmetric algorithms such as RS256 need a private key and are not signed here.

Should I use this to sign production tokens?

Treat signing here as a development and debugging aid. For real tokens, sign on a trusted server and never expose production signing secrets in a browser.

Related Testing & Debug tools