Advanced JWT Debugger

Decode, Edit, Verify, and Sign JSON Web Tokens locally. No data leaves your browser.

Encoded Token
Empty
Verify Signature
Awaiting Secret
Header
Payload
Formulate JWT
Generated Token
Token Builder — Standard Claims
Generated Token
Decoded Preview
Build a token to see the decoded payload here.
JWT Algorithm Cheat-Sheet
AlgorithmTypeKeyStrengthBest for
HS256Symmetric HMACShared secret128-bitServer-to-server, internal APIs
HS384Symmetric HMACShared secret192-bitHigher-assurance internal tokens
HS512Symmetric HMACShared secret256-bitLongest HMAC — overkill for most uses
RS256Asymmetric RSAPrivate + Public2048-bit keyPublic key distribution (OAuth 2, OIDC)
RS384Asymmetric RSAPrivate + Public2048-bit keyLegacy compliance
RS512Asymmetric RSAPrivate + Public2048-bit keyHigh-security public-key scenarios
ES256Asymmetric ECDSAEC P-256 key pair128-bit equiv.Mobile apps, shorter tokens
ES384Asymmetric ECDSAEC P-384 key pair192-bit equiv.Financial services, high-security APIs
noneUnsecuredNone⚠️ No securityTesting only — never in production
Quick decision guide:
  • HS256 — default for server-side APIs where you control all parties
  • RS256 — use when third parties need to verify tokens without the signing secret (e.g. OIDC)
  • ES256 — same as RS256 but smaller signatures; prefer for mobile/IoT bandwidth
  • HS384/HS512 — rarely needed; SHA-256 collision resistance is sufficient for JWTs
Standard Authorization Code Flow with JWT

Understanding Authentication Tokens

JSON Web Tokens (JWT) are lightweight, cryptographically signed tokens primarily used to authorize requests against modern REST APIs and microservices. Because the server can mathematically verify a JWT's signature locally, it rarely needs to query a database to authenticate a request.

SAML (Security Assertion Markup Language) is a robust, XML-based standard primarily used for Enterprise Single Sign-On (SSO) systems. It requires heavier back-and-forth parsing and is highly secure, but JWT's JSON format makes it significantly easier to transmit across HTTP headers in web and mobile applications.

The Authorization Code flow securely exchanges a temporary code for an Access Token (JWT).

graph TD
    User([Resource Owner])
    Client[Client App]
    AuthServer[(Auth Server)]
    API[(API Server)]
    
    User -->|1. Clicks Login| Client
    Client -->|2. Requests Auth Code| AuthServer
    AuthServer -.->|3. Prompts for Consent| User
    User -.->|4. Grants Consent| AuthServer
    AuthServer -->|5. Returns Auth Code| Client
    Client -->|6. Exchanges Code for Tokens| AuthServer
    AuthServer -->|7. Returns Access Token JWT| Client
    Client -->|8. API Call with Bearer JWT| API
    API -->|9. Validates JWT & Returns Data| Client

JWT Token Structure

A JSON Web Token consists of three parts separated by dots, each Base64Url encoded.

graph LR
    JWT[Encoded JWT Token]
    Header[Header: Algorithm & Type]
    Payload[Payload: Data & Claims]
    Signature[Signature: Verification]
    
    JWT -->|Part 1| Header
    JWT -->|Part 2| Payload
    JWT -->|Part 3| Signature
    
    style Header fill:#df3852,stroke:#fff,stroke-width:2px,color:#fff
    style Payload fill:#d72199,stroke:#fff,stroke-width:2px,color:#fff
    style Signature fill:#4d7dff,stroke:#fff,stroke-width:2px,color:#fff

Frequently Asked Questions

Is my JWT token safe when I paste it here?

Yes. All JWT decoding and signature verification happens entirely in your browser using the Web Crypto API. Your tokens, signing keys, and payloads never leave your device or touch our servers.

What JWT signing algorithms are supported?

The debugger supports HMAC-based algorithms (HS256, HS384, HS512) for symmetric verification and RS256, ES256 for asymmetric key pairs. You can verify the signature by providing your secret key or public key directly in the tool.

How do I check if a JWT token has expired?

Paste your JWT into the debugger and switch to the Payload view. The tool automatically detects the exp (expiration) claim and shows a live countdown of how long until the token expires, or how long ago it expired.