JWT Debugger
Decode, inspect, verify HS* signatures, and rebuild JSON Web Tokens.
The JWT Debugger is an indispensable utility for developers working with JSON Web Tokens. It allows you to swiftly deconstruct a JWT, revealing its individual components: the header, the payload, and the signature. Whether you're troubleshooting an authentication flow, examining the claims issued by an API, or verifying the integrity of a token you've just generated, this tool provides immediate insights. For instance, if your application is rejecting a token, you can paste it here to confirm if it's expired, if a crucial claim is missing, or if the signature is invalid due to a wrong secret or tampering.
Simply input your JWT string, and the tool will automatically parse it, presenting the decoded base64url content in a human-readable format. For robust security checks, the JWT Debugger also supports verifying HS* (HMAC-SHA) signatures. By providing the correct secret key, you can quickly ascertain if the token has been altered since it was issued or if the signature was generated with the wrong key. This is crucial for maintaining trust in your token-based authentication systems. A key tip: while the tool excels at debugging and inspecting, remember that signature verification for algorithms like RS256 (RSA Signature with SHA-256) typically requires private keys and is best handled server-side due to key management complexities. This tool focuses on common debugging scenarios for symmetric keys.
How to use JWT Debugger
Paste Your JWT String
Copy your full JSON Web Token and paste it into the designated input area. The tool will automatically begin decoding.
Inspect Header and Payload
Review the "Header" and "Payload" sections to see the decoded JSON data, including algorithm details, token type, and any claims like user IDs or expiration times.
Enter Your Secret Key (Optional)
If your JWT uses an HS* signature (e.g., HS256, HS384, HS512), input your secret key into the "Secret" field to enable signature verification.
Check Signature Status
Observe the "Signature" section. It will indicate whether the signature is valid, invalid, or if a secret key is required for verification.
Rebuild Token (Optional)
Make changes to the header or payload, and the tool can rebuild a new JWT string with an updated signature (if a secret is provided).
Frequently Asked Questions
What JWT algorithms does the JWT Debugger support for signature verification?
This tool primarily supports symmetric algorithms for signature verification, specifically HS256, HS384, and HS512 (HMAC with SHA-256, SHA-384, and SHA-512, respectively). You'll need to provide the correct secret key.
Can I use this tool to generate new JWTs from scratch?
The JWT Debugger is designed for inspection and debugging existing tokens. While you can modify the decoded header or payload and then rebuild a token, it doesn't offer a full JWT creation interface from scratch.
What does it mean if the signature is "invalid"?
An "invalid" signature usually indicates that the token's content (header or payload) has been tampered with since it was issued, or that the wrong secret key was used for verification. It could also mean the token itself is malformed or corrupted.
Is my secret key or JWT data stored or sent to a server?
No, the JWT Debugger processes all data, including your JWT string and any provided secret keys, entirely within your browser. Nothing is sent to our servers, ensuring your sensitive information remains private.
Why can't I verify tokens signed with RS256 or ES256?
Asymmetric algorithms like RS256 (RSA) and ES256 (ECDSA) require public/private key pairs for verification, which are typically managed securely on servers. This tool focuses on client-side symmetric key verification, which is common for debugging and inspection.
What happens if I paste a malformed or non-JWT string?
If the string you paste is not a valid three-part JWT (header.payload.signature) or if its parts are not base64url-encoded correctly, the tool will display an error message indicating that it cannot parse the token.