Developer Utility • 100% Client-Side

JSON Web Token (JWT) Debugger

Decode, encode, inspect claims, and verify HMAC signatures in real-time. Built entirely with the native Web Crypto API.

Tokens are never transmitted over the network.

Encoded Token

Valid 3-Part JWT

Header Payload Signature

Sample:

Header: Algorithm & Token Type

JSON

Payload: Data Claims

JSON

Time Claims Analysis

Verify Signature & Secret Key

✓ Signature Verified

Algorithm:

Secret base64 encoded

Secret Key (HMAC passphrase):

Tip: Modifying any JSON field above or changing the secret key immediately recalculates the cryptographic signature and updates the token on the left in real time.

Frequently Asked Questions

Everything you need to know about JSON Web Tokens and security.

Q: Is it safe to paste private JWT tokens here?

Yes, 100%. All decoding, JSON formatting, and signature verification are executed exclusively inside your local browser using the native Web Crypto API. No token, payload, or secret key is ever transmitted over the network or stored on any server.

Q: How does the bi-directional Encoder & Decoder work?

When you paste a token into the Encoded box on the left, it automatically decodes the Header and Payload into readable JSON on the right. Conversely, if you edit any JSON field or change the Secret Key on the right, it instantly re-signs and computes a brand new valid JWT on the left.

Q: Which algorithms are supported for signature verification?

We natively support symmetric HMAC algorithms (HS256, HS384, and HS512) via browser SubtleCrypto. You can verify signatures or generate new signatures in real-time.

Q: What do the colors in the Encoded Token represent?

A standard JWT consists of three parts separated by dots: Red/Pink represents the Base64URL-encoded Header, Purple/Violet represents the Payload claims, and Cyan/Blue represents the cryptographic Signature.