Security & Cryptography

JWT Debugger & Decoder

Decode, validate, edit, and verify JSON Web Tokens (JWT) client-side. Test HS256 signatures safely without uploading data to servers.

Encoded Token (Paste here)
Verify Signature (HS256)
Signature validation pending
HEADER: Algorithm & Token Type
PAYLOAD: Data / Claims

Related Tools You Might Need

Hash Generator Generate cryptographic MD5, SHA-1, SHA-256, and SHA-512 hashes from input text. Fully secure and processed locally in your browser.
Caesar Cipher Tool Encrypt or decrypt text online using the classic Caesar Cipher algorithm. Customize shift values and encoding instantly.
Word Counter & Text Analyzer Count words, characters, sentences, paragraphs, and lines in your text. Analyze estimated reading time, speaking time, and case transformations.

What is this tool?

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs consist of three parts separated by dots (.): Header, Payload, and Signature.

How to use it

1. Paste your encoded JWT token into the left-hand text area.

2. The Header, Payload, and Signature will instantly decode and show on the right.

3. Enter your secret key in the signature area to verify the token's authenticity.

4. Modify any header or payload parameters to generate a new encoded token dynamically.

Pro tips

  • Hover over timestamp claims like "exp" (expiration) or "iat" (issued at) to see human-readable date formats in local time.
  • Check the "Secret is Base64 encoded" box if your secret key is in base64/base64url format.

Frequently asked questions

Is my JWT data secure?

Yes. All parsing, validation, and signature verification are processed 100% client-side inside your browser using Javascript and the Web Crypto API. Your tokens and secret keys are never sent to any server.

How does signature verification work?

For HS256 (HMAC-SHA256) signatures, you can type your secret key into the verifier box. The browser will compute the HMAC signature of the header and payload and check if it matches the token's signature. Checkboxes allow you to specify if the secret is raw text or base64url-encoded.

Can I edit the JWT and create a new one?

Yes! If you modify the JSON fields in the decoded Header or Payload panels, the debugger will automatically re-encode the parts and update the JWT string on the left in real time.