JWT tools
Inspect, verify, and generate JSON Web Tokens without ever sending a live token or secret to a server.
JWT Decoder & Debugger Online — Free & Private
Decode any JWT's header and payload, check exp/iat/nbf expiry, and verify HS256 signatures — 100% in your browser, tokens never uploaded.
JWT Generator Online — HS256, Free & Private
Generate signed HS256 JWTs in seconds — set issuer, subject, audience, expiry, and custom claims. Signing happens in your browser; nothing is sent.
What the three parts of a JWT are
A JSON Web Token is three base64url segments separated by dots: a header naming the algorithm, a payload of claims, and a signature covering the first two.
The header and payload are encoded, not encrypted. Anyone holding the token can read them, which is why decoding needs no key at all, and why a token should never be used to carry a secret.
Decoding is not verification
Opening a token in a debugger says nothing about whether it can be trusted. A token that declares alg as none carries no signature at all, and a tool that presented its claims as verified would be actively misleading.
This debugger keeps the two ideas apart. It decodes the token, renders the claims as a table, flags alg:none and expired tokens explicitly, and leaves signature checking to your own verifier or to the generator.
What to check when a token is rejected
The time checks are rendered as plain sentences such as expired 3 days ago, because reading numeric timestamps by eye across two timezones is how expiry bugs survive to production.
- exp in the past means the token expired, so compare it against the current clock rather than against iat
- nbf in the future means the token is not valid yet, which is common when services disagree about the time
- A different kid means the signature was produced with a key your verifier may not hold
- aud and iss must match what the accepting service expects, or a token minted for another system can be accepted by mistake
Frequently asked questions
Is it safe to paste a real JWT here?
Decoding happens in your browser and nothing is transmitted, so the token does not leave the machine. Treat any token you paste anywhere as potentially exposed, and rotate it if you are unsure.
Can this tool verify a signature?
It signs and verifies HS256, which is HMAC-SHA-256. Asymmetric algorithms such as RS256 and ES256 need a public key in JWK or PEM form and are not handled here.
Why does it warn about alg:none?
A token declaring alg:none is unsigned. A verifier that accepts one lets an attacker forge any claims they like, so the debugger calls it out instead of treating it as an ordinary token.
How can a token be unexpired and still be invalid?
exp is the expiry time and nbf is the earliest time the token becomes valid. A token can be not yet valid and far from expiry at the same time, usually because the issuing and accepting services disagree about the clock.