Encoded Token

Invalid JWT

No data

Signature Verification (OPTIONAL)

Enter the secret used to sign the JWT below:

Secret Key

Encoding Format

Verification happens entirely in your browser. No tokens are sent to external servers.

Decoded Header

No data

Decoded Payload

No data

Signature

No data

What is JWT?

JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties. It is digitally signed, making it verifiable and trustworthy. JWTs can be signed using HMAC algorithms or RSA/ECDSA public/private key pairs.

xxxxx.yyyyy.zzzzz

Header: Algorithm and token type information

Payload: Claims (user info and metadata)

Signature: Signature for token integrity verification

Registered Claims

iss

Issuer - The entity that issued the token

sub

Subject - The subject of the token (usually user ID)

aud

Audience - The recipients the token is intended for

exp

Expiration Time - Unix timestamp when token expires

nbf

Not Before - Token is invalid before this time

iat

Issued At - Unix timestamp when token was issued

jti

JWT ID - Unique identifier for the token

JWT Use Cases

Authentication
Issue JWT after user login to verify identity in subsequent requests
Information Exchange
Verify sender identity and detect content tampering through signatures
Single Sign-On (SSO)
Maintain authentication across multiple services with a single token
API Authorization
Secure API call authentication between microservices

Security Considerations

JWT is encoded, not encrypted. Never include sensitive information (passwords, credit cards, etc.) in the payload.
Use a strong secret key of at least 256 bits.
Set appropriate token expiration (exp) and consider using refresh token patterns.
Store tokens in httpOnly cookies instead of localStorage to prevent XSS attacks.
Always use HTTPS in production to prevent token exposure over the network.

Supported Algorithms

HS256

HMAC + SHA-256. The most commonly used symmetric key algorithm

HS384

HMAC + SHA-384. Enhanced security with longer hash than HS256

HS512

HMAC + SHA-512. Symmetric key algorithm with the longest hash

This tool only supports HMAC-based symmetric algorithms (HS*). RSA/ECDSA asymmetric algorithms require separate public/private key pairs.

What is the JWT Debugger?

A tool that decodes JSON Web Tokens to analyze headers, payloads, and signatures, and generate new JWT tokens. Visually inspect token claims (issuer, expiration, user info, etc.) and verify signatures using HMAC algorithms (HS256/HS384/HS512). All processing happens in the browser to keep tokens secure.

How to Use

Frequently Asked Questions

Tips & Best Practices

What is the JWT Debugger?