JWT Debugger

Usage Guide

A JWT has three parts: header, payload, and signature. It is commonly used for sessions, API authorization, and signed claims between services. Paste a token on the left and decode it to inspect the algorithm, type, subject, expiration, issued-at time, roles, and scopes. To create a test token, edit the header and payload JSON, provide an HMAC SHA-256 secret, and sign it locally. During debugging, pay close attention to exp, nbf, and iat units and timezones, and confirm that frontend, gateway, and backend services expect the same key and algorithm.

Examples

• When an API returns 401, decode the token and check exp, aud, and iss against backend expectations.
• For local permission testing, add a role or scope claim and sign a temporary development token.
• When gateway verification fails, compare the header alg with the server verification configuration.

FAQ

• Does successful decoding mean the token is valid? No. It only means the structure is readable; trust depends on signature and claim validation.
• Should I paste production secrets? Avoid doing that on shared machines, during screen sharing, or in untrusted environments.
• Why does the backend reject a signed token? Check the secret, algorithm, time claim units, issuer, audience, and required custom claims.