JWT Decoder & Debugger
Decode and inspect JSON Web Tokens — view header, payload, and signature claims. Verify HS256/384/512, RS256, ES256 signatures and check token expiration.
Tip: press Ctrl/⌘ + Enter in the key field to verify. For RSA/ECDSA tokens paste the PEM public key.
About this tool
Paste a JSON Web Token to instantly decode its header and payload, inspect registered claims (iss, sub, aud, exp, nbf, iat), and check whether the token is expired. For HMAC-signed tokens (HS256, HS384, HS512) verify against a shared secret; for RSA (RS256/384/512), RSA-PSS (PS256/384/512), and ECDSA (ES256/384/512) tokens paste the PEM-encoded public key.
The algorithm badge turns red and warns "alg=none — unsigned" whenever a token carries no signature, which is the classic confused-deputy vulnerability class — never accept such tokens in production unless you intentionally issued them unsigned.
FAQ
What is the difference between decoding and verifying a JWT? ›
Decoding reads the base64url-encoded header and payload — anyone can do this, because they are not encrypted. Verifying recomputes the signature with your secret and confirms the token has not been tampered with. A token can be perfectly decodable yet forged, so always verify before trusting claims.
Why does the debugger say "alg=none — unsigned"? ›
The JWT header declares its own algorithm. When alg is "none" the signature section is empty and the token carries no proof of authenticity. Accepting such tokens server-side is a well-known vulnerability; the badge flags it so you notice immediately.
Can I verify RS256 / ES256 tokens here? ›
Yes. Paste the PEM-encoded public key (the block starting with -----BEGIN PUBLIC KEY-----) into the key field and click Verify. The debugger supports RS256/384/512 (RSA), PS256/384/512 (RSA-PSS), and ES256/384/512 (ECDSA). Only the public key is needed — never paste the private key. The raw R‖S signature format used by JWT is converted internally for verification.
Is my token sent anywhere? ›
No. Decoding and HMAC verification run entirely in your browser using the Web Crypto API. Nothing is uploaded, so it is safe to paste development tokens — though you should still avoid pasting production bearer tokens into any web tool.
Can this tool create a JWT from scratch? ›
No — this debugger decodes and verifies existing tokens. To create a signed JWT with custom claims, expiry, and your choice of algorithm (HS256, RS256, ES256), use the JWT Generator tool which builds and signs tokens entirely in the browser.