BAS HUGE SALE + FREE SHIPPING
🔒 No upload - tokens never leave your browser

JWT Debugger

Decode any JSON Web Token and read its claims in plain language: expiry, not-before, issuer and audience. Spot unsigned alg "none" tokens and verify HS*, RS*, PS* and ES256 signatures locally in your browser.

Paste a token to start.
Algorithm (alg)—
Type (typ)—
Key ID (kid)—
Issuer (iss)—
Subject (sub)—
Audience (aud)—
Issued at (iat)—
Not before (nbf)—
Expires (exp)—
JWT ID (jti)—
Other claims—
Signaturenot checked
—
—
Decoding and verification run entirely in this browser tab. The token and the key are never uploaded.

What the JWT Debugger does

The JWT Debugger decodes a JSON Web Token and shows what is really inside it. Paste a token and the header and payload appear as readable JSON, followed by the registered claims in plain language: who issued the token, who it is meant for, when it was issued, when it becomes valid and when it expires. Expired tokens, tokens that are not valid yet and tokens without an exp claim are labelled immediately. If the header says alg "none", the tool warns you, because such a token carries no signature at all and anyone can change its payload. With a shared secret or a PEM public key you can also verify HS256/384/512, RS256/384/512, PS256/384/512 and ES256/384/512 signatures. Everything runs in your browser: token and key are never uploaded. The tool does not create or sign tokens and it cannot fetch an issuer key set (JWKS) for you.

More free tools

Free online utility tools. No signup. No tracking.

Impressum · Sitemap · Some links contain affiliate advertising