JWT Debugger - Decode Verify Generate JWT Tokens | Free Online Tool

Encoded Token

Paste your JWT token here...

Invalid JWT

No data

Signature Verification (OPTIONAL)

Enter the secret used to sign the JWT below:

Secret Key

Enter the secret key used to sign the token

Encoding Format

Select...

Verification happens entirely in your browser. No tokens are sent to external servers.

Decoded Header

No data

Decoded Payload

No data

Signature

No data

What is JWT?

JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties. It is digitally signed, making it verifiable and trustworthy. JWTs can be signed using HMAC algorithms or RSA/ECDSA public/private key pairs.

xxxxx.yyyyy.zzzzz

Header: Algorithm and token type information

Payload: Claims (user info and metadata)

Signature: Signature for token integrity verification

Registered Claims

iss

Issuer - The entity that issued the token

sub

Subject - The subject of the token (usually user ID)

aud

Audience - The recipients the token is intended for

exp

Expiration Time - Unix timestamp when token expires

nbf

Not Before - Token is invalid before this time

iat

Issued At - Unix timestamp when token was issued

jti

JWT ID - Unique identifier for the token

JWT Use Cases

Authentication
Issue JWT after user login to verify identity in subsequent requests
Information Exchange
Verify sender identity and detect content tampering through signatures
Single Sign-On (SSO)
Maintain authentication across multiple services with a single token
API Authorization
Secure API call authentication between microservices

Security Considerations

JWT is encoded, not encrypted. Never include sensitive information (passwords, credit cards, etc.) in the payload.
Use a strong secret key of at least 256 bits.
Set appropriate token expiration (exp) and consider using refresh token patterns.
Store tokens in httpOnly cookies instead of localStorage to prevent XSS attacks.
Always use HTTPS in production to prevent token exposure over the network.

Supported Algorithms

HS256

HMAC + SHA-256. The most commonly used symmetric key algorithm

HS384

HMAC + SHA-384. Enhanced security with longer hash than HS256

HS512

HMAC + SHA-512. Symmetric key algorithm with the longest hash

This tool only supports HMAC-based symmetric algorithms (HS*). RSA/ECDSA asymmetric algorithms require separate public/private key pairs.

What is the JWT Debugger?

A tool that decodes JSON Web Tokens to analyze headers, payloads, and signatures, and generate new JWT tokens. Visually inspect token claims (issuer, expiration, user info, etc.) and verify signatures using HMAC algorithms (HS256/HS384/HS512). All processing happens in the browser to keep tokens secure.

Header, payload, and signature analysis through JWT decoding
Signature verification with HS256, HS384, and HS512
JWT generation with a custom payload (Encoder)
Visual inspection of claims such as iss, sub, exp, and iat
Automatic token-expiration detection and display
In-browser processing to keep token data private

How to Use

1
Choose Decoder or Encoder
Choose the Decoder tab to analyze an existing JWT or the Encoder tab to create a new one.
2
Enter a Token (Decoder)
Paste a JWT string to decode and display its header and payload automatically.
3
Verify the Signature
Enter the secret key and click Verify to check whether the signature is valid.
4
Generate a Token (Encoder)
Choose an algorithm and secret key, then enter header and payload JSON to generate a JWT.

Frequently Asked Questions

No. A JWT is Base64-encoded, not encrypted. Anyone can decode it, so never include sensitive information such as passwords or credit card numbers in the payload.

Both are HMAC-based symmetric-key algorithms, but HS256 uses SHA-256 and HS512 uses SHA-512. HS512 produces a longer hash and offers a larger security margin, though HS256 is sufficient for most use cases.

A JWT is expired when its exp (expiration time) claim is earlier than the current time. Request a new token from the server or renew it with a refresh token.

No. All decoding and signature verification is performed locally with your browser's Web Crypto API. Token data is not sent to a server or any external service.

The tool currently supports only HMAC-based symmetric-key algorithms: HS256, HS384, and HS512. Asymmetric algorithms such as RS256 and ES256 require a public/private key pair and a separate tool.

Tips & Best Practices

When debugging an API, copy and analyze the token after Bearer in the Authorization header
Check the token's exp claim to verify that its expiration time is set correctly
Use a strong secret key of at least 256 bits (32 bytes)
Never enter a production token into an online debugger; use a browser-only tool like this one
Use the timestamp refresh feature in the Encoder to update iat and exp quickly from the current time

What is the JWT Debugger?

Header, payload, and signature analysis through JWT decoding

Signature verification with HS256, HS384, and HS512

JWT generation with a custom payload (Encoder)

Visual inspection of claims such as iss, sub, exp, and iat

Automatic token-expiration detection and display

In-browser processing to keep token data private

How to Use

Choose Decoder or Encoder

Choose the Decoder tab to analyze an existing JWT or the Encoder tab to create a new one.

Enter a Token (Decoder)

Paste a JWT string to decode and display its header and payload automatically.

Verify the Signature

Enter the secret key and click Verify to check whether the signature is valid.

Generate a Token (Encoder)

Choose an algorithm and secret key, then enter header and payload JSON to generate a JWT.

Frequently Asked Questions

No. A JWT is Base64-encoded, not encrypted. Anyone can decode it, so never include sensitive information such as passwords or credit card numbers in the payload.

A JWT is expired when its exp (expiration time) claim is earlier than the current time. Request a new token from the server or renew it with a refresh token.

No. All decoding and signature verification is performed locally with your browser's Web Crypto API. Token data is not sent to a server or any external service.

The tool currently supports only HMAC-based symmetric-key algorithms: HS256, HS384, and HS512. Asymmetric algorithms such as RS256 and ES256 require a public/private key pair and a separate tool.

Tips & Best Practices

When debugging an API, copy and analyze the token after Bearer in the Authorization header

Check the token's exp claim to verify that its expiration time is set correctly

Use a strong secret key of at least 256 bits (32 bytes)

Never enter a production token into an online debugger; use a browser-only tool like this one

Use the timestamp refresh feature in the Encoder to update iat and exp quickly from the current time