Security Tools

JWT Debugger

Inspect JSON Web Tokens quickly while debugging authentication, OAuth, OpenID Connect, API gateway, and cloud identity flows.

How to use this tool

  1. Paste a JWT into the encoded token panel.
  2. Review the decoded header and payload JSON.
  3. Check expiry, issued-at, and not-before claims in the timeline.
  4. Select the expected signing algorithm and provide a verification key or secret when you need signature validation.
  5. Use redacted sharing when you want to discuss token structure without exposing values.

Examples

  • Debug an expired access token by checking the exp, iat, and nbf claims.
  • Compare two token payloads to understand which claims changed between environments.
  • Verify an HS256 token with a shared secret or an RS256 token with a public key.

Important concepts

  • A JWT has three base64url-encoded sections: header, payload, and signature.
  • The header declares metadata such as typ, alg, and sometimes kid.
  • The payload contains claims such as iss, sub, aud, exp, iat, scopes, and application-specific fields.
  • Signature verification confirms that the token matches the supplied secret or public key.

Common problems

  • Expired tokens caused by short lifetimes or clock skew.
  • Audience or issuer claims that do not match the receiving API.
  • Using the wrong verification key for the token algorithm.
  • Accidentally sharing PII or sensitive claims while debugging.

Frequently asked questions

Can this tool verify signed JWTs?

Yes. It supports the listed HMAC, RSA, RSA-PSS, and ECDSA algorithms through the browser crypto APIs when the matching secret or public key is provided.

Should I paste production tokens?

Use care with production credentials. The tool logic is browser-local, but organizational policy should decide whether real tokens can be inspected in any web tool.

Related tools

  • Base64 Encoder & Decoder

    Encode text to Base64, decode Base64 to text, convert Base64URL values, and work with local files using copy, swap, and download controls.

  • JSON Formatter & Validator

    Format, beautify, minify, validate, copy, and export JSON with line-aware error feedback.

  • Secure Password Generator

    Generate strong passwords with configurable policy controls, copy actions, and text export.

  • UUID Generator

    Generate RFC 4122 UUID v4 and GUID identifiers with simple formatting, copy, batch, and export controls.

  • Regex Tester & Visualizer

    Create, test, debug, and explain JavaScript regular expressions with live matches and capture groups.

  • Salesforce ID Converter

    Convert Salesforce record IDs between 15-character and 18-character formats with single and bulk browser-based conversion.