JWT Debugger
Paste any JWT to decode its header, payload, and signature. Inspect all claims with descriptions, check expiry status, and visualize the token structure — completely client-side, nothing sent to any server.
Real-World Use Cases
1. Debugging a "401 Unauthorized" API Error
Your frontend gets a 401 from the API. Paste the JWT from the Authorization: Bearer header to check: Is the token expired? Does the aud claim match the expected audience?
What You See
Header: {"alg": "RS256", "typ": "JWT"}
Payload:
"sub": "user_42"
"aud": "api.staging.com" ← wrong!
"exp": 1712300000 ← expired
"iat": 1712296400 Diagnosis
✗ Token expired 2 hours ago ✗ Audience mismatch: Expected: api.production.com Got: api.staging.com Fix: refresh the token and ensure AUTH_AUDIENCE env var points to production.
2. Verifying OAuth 2.0 Scopes After Login
After implementing Google or GitHub OAuth, paste the id_token to verify the granted scopes, user email, and issuer match your OAuth configuration.
Decoded Payload
{
"iss": "https://accounts.google.com",
"sub": "1102938475610",
"email": "[email protected]",
"email_verified": true,
"scope": "openid email profile",
"exp": 1712389200
} Checklist
✓ Issuer matches Google ✓ Email is verified ✓ Scopes include "email" ✓ Token valid for 50 more min Safe to create user session.
3. Comparing HS256 vs RS256 Token Structure
Learning about JWT algorithms? Paste tokens signed with different algorithms side-by-side. The debugger shows the alg field in the header, making it easy to see how HS256 (symmetric) and RS256 (asymmetric) differ in practice.
HS256 Header
{"alg": "HS256", "typ": "JWT"}
→ Signed with shared secret
→ Signature: 32 bytes HMAC RS256 Header
{"alg": "RS256", "typ": "JWT", "kid": "abc123"}
→ Signed with private key
→ Signature: 256 bytes RSA
→ kid identifies which key How to Use — Step by Step
- Copy the JWT — Grab the token from your browser DevTools (Application → Cookies or Network → Headers), API response, or auth library's debug output.
- Paste the token — Paste the full
eyJhbG...string into the input field. The tool splits and decodes all three parts instantly. - Check the header — Verify the algorithm (
alg) matches what your backend expects. Mismatches cause verification failures. - Inspect the payload — Review claims like
exp(expiry),sub(subject), andiss(issuer). The tool highlights expired tokens and explains each standard claim. - Debug — Use the decoded information to fix auth issues: wrong audience, expired token, missing roles, or algorithm mismatch.
Frequently Asked Questions
What is a JWT token?▼
A JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting claims between parties. It consists of three Base64URL-encoded parts: header (algorithm and token type), payload (claims like user ID, roles, expiry), and signature (for verifying authenticity). JWTs are widely used in API authentication and OAuth 2.0 flows.
Is it safe to paste my JWT token here?▼
Yes — this tool runs entirely in your browser. Your token is never sent to any server. However, avoid pasting production tokens from sensitive systems into any online tool as a best practice. For debugging production issues, consider using a local tool or redacting sensitive claims.
Why is the signature shown but not verified?▼
JWT signature verification requires your secret key (for HMAC algorithms like HS256) or the public key (for RSA/EC algorithms like RS256/ES256). Since these keys should never be shared or sent to a browser, client-side signature verification is not possible. Use your backend or jwt.io for signature verification with your key.
What do iat, exp, nbf, sub, iss mean?▼
These are registered JWT claims: iat (Issued At) — Unix timestamp when the token was created. exp (Expiration) — Unix timestamp when it expires; tokens after this time are invalid. nbf (Not Before) — token is not valid before this time. sub (Subject) — the user or entity the token represents. iss (Issuer) — who created and signed the token.
What is the difference between HS256 and RS256?▼
HS256 (HMAC-SHA256) uses a shared secret key — the same key is used to sign and verify. It's simpler but requires all parties to share the secret. RS256 (RSA-SHA256) uses a public/private key pair — the private key signs, the public key verifies. RS256 is better for distributed systems where multiple services verify tokens without access to the signing key.
Related Products
on GumroadDeveloper Productivity Bundle
Stop rebuilding the same setup every project. 51 VSCode snippets, 40 Git aliases, 5 Docker Compose stacks, 5 GitHub Actions workflows, 5 README templates, and a dotfiles kit. Set up a professional dev environment in under an hour.
Buy on Gumroad →AI Prompt Engineering Toolkit
58 structured prompt templates for Claude, ChatGPT, and Gemini — organized by use case. Code Review, Debugging, Documentation, Architecture, and 10 model-specific tips. Stop writing prompts from scratch.
Buy on Gumroad →Developer Cheat Sheet Bundle
10 print-ready cheat sheets for the tools developers use every day: Git, Docker, Linux CLI, SQL, Regex, HTTP Status codes, VS Code shortcuts, Bash scripting, jq/JSON, and Markdown.
Buy on Gumroad →You Might Also Need
JWT Decoder
Free JWT decoder. Inspect any JSON Web Token
Open free tool →
OpenAPI Validator
Paste your OpenAPI 3.x spec (YAML or JSON) to validate structure, find missing required fields, detect duplicate paths, check for missing operationIds, and get errors and warnings with path references.
Open free tool →
API Response Mock Generator
Generate realistic mock API responses with custom status codes, headers, and JSON body. Quick templates for 200, 401, 404, 429, 500 and more. Runs in your browser.
Open free tool →
More Free Tools
Related Articles
JWT Authentication Best Practices 2026: Secure Your API Tokens
Complete JWT security guide for 2026. Covers RS256 vs HS256 signing, token storage strategies, expiry and refresh token patterns, revocation, common vulnerabilities, and a production security checklist.
JWT Token Decoder: How to Debug Authentication Issues
Learn how to use a JWT token decoder to diagnose 401 errors, expired tokens, missing claims, and auth misconfiguration. Practical debugging guide with code examples.
JWT Tokens Explained: How to Decode and Debug Them
Understand JSON Web Tokens from header to signature. Learn how to decode JWTs, read their claims, debug authentication issues, and use free online JWT tools.
JWT Decoder: How to Read Token Payloads
Learn how to decode JWT tokens and read their payloads. A practical guide to JWT structure, claims, expiry checking, and debugging auth issues with a free online decoder.
Authentication Security Tools 2026: Modern Auth Patterns, MFA, Passwordless, and OAuth2
Complete guide to authentication security tools in 2026. Covers Auth0, Clerk, NextAuth.js v5, JWT security, Passkeys/WebAuthn, TOTP authenticator apps, OAuth2/OIDC, session management, and building secure auth systems with Node.js and Python.
Enjoying this tool? Get more like it.
Weekly developer tool guides, productivity playbooks & AI tricks. Free. No spam.
Unlock AI-Powered Dev Tools
- ⚡ AI Code Review, Doc Generator & SQL Builder
- ⚡ All premium templates & early access
- ⚡ Member discounts on Gumroad products
$9/mo after trial · Cancel anytime
Want the full toolkit?
Get DevPlaybook Pro
Every template, guide, boilerplate, and automation script in one bundle. 13 premium products — grab them all at once and save big.
MIT licensed · Instant download · No subscription
See what's included → Browse all deals →