JWT Debugger

TOKEN LAB

JWT Debugger

Decode, verify, and generate JSON Web Tokens locally.

Start now

JWT Debugger Help, Examples, and FAQ

Use the JWT debugger to inspect a compact token’s header and claims, compare exp, nbf, iss, and aud with backend expectations, or create a temporary HS256 token for local testing. Decoding is not verification: a readable payload can still have an invalid signature, unsafe algorithm, or unacceptable claims.

How to use it

Paste a three-part token and decode it to inspect the header and payload. For a development token, edit both JSON objects, enter a non-production HMAC secret, and generate an HS256 signature. Verify trust separately in the receiving system.

Worked example

Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.signature
Output
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"123"}

Useful scenarios

  • When an API returns 401, decode the token and check exp, aud, and iss against backend expectations.
  • For local permission testing, add a role or scope claim and sign a temporary development token.
  • When gateway verification fails, compare the header alg with the server verification configuration.

Supported behavior and limits

  • Decodes three-part compact JWT strings with Base64URL-encoded JSON header and payload sections.
  • Generates HMAC SHA-256 (HS256) signatures with the browser Web Crypto API; it does not verify pasted signatures.
  • Requires a modern secure-context browser with Web Crypto. No fixed input limit is enforced.

Privacy and data handling

Token, claims, and HMAC secret stay in the browser. Avoid production secrets on shared devices, screen recordings, or copied examples.

Frequently asked questions

  • Does successful decoding mean the token is valid? No. It only means the structure is readable; trust depends on signature and claim validation.
  • Should I paste production secrets? Avoid doing that on shared machines, during screen sharing, or in untrusted environments.
  • Why does the backend reject a signed token? Check the secret, algorithm, time claim units, issuer, audience, and required custom claims.
Content maintained by GoTools EngineeringThis update added an example, supported limits, privacy details, and references.

Related Tools

Password Generator

Generate strong, customizable passwords in one click.

Try it

LLMs.txt Checker

Score AI-facing site guidance and resource links.

Try it

Cron Expression Generator

Visually create cron schedules.

Try it
JWT Debugger & Generator | GoTools