What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It consists of three Base64URL-encoded parts separated by dots: a header (signing algorithm and token type), a payload (claims such as sub, iat, exp), and a signature for tamper-proof verification.

Is it safe to paste production JWT tokens here?

Yes. This tool processes everything 100% client-side in your browser. Your JWT tokens never leave your device — there are no API calls, no server-side processing, and no data storage. You can verify this by checking your browser network tab.

Which JWT signing algorithms are supported?

Full HMAC signature verification is supported for HS256, HS384, and HS512. For asymmetric algorithms (RS256/384/512, ES256/384/512, PS256/384/512), the tool decodes and displays the token, and can verify signatures via JWKS endpoint fetching.

What is JWKS and how does key verification work?

JWKS (JSON Web Key Set) is a JSON format defined in RFC 7517 that represents a set of public keys. Identity providers publish their JWKS at a well-known endpoint. The debugger fetches the JWKS, matches the key using the kid header claim, and verifies the signature against the correct public key.

Can I decode an expired JWT token?

Yes. Token expiration is just a claim (exp) in the payload — it does not prevent decoding. The tool decodes expired tokens and clearly indicates when a token has expired or is not yet valid via the nbf (not before) claim.

Security & Auth

JWT Debugger

Free online JWT debugger. Decode, verify signatures (HMAC, RSA, ECDSA), encode tokens, and compare JSON Web Tokens side-by-side. 100% client-side — your tokens never leave your browser.

Open tool

Quick reference

Category: Security & Auth
Runs in: Browser
Data stored: Nothing
Price: Free
Sign-up: Not needed

Browse categories

All features

JWT decoding and inspection
HMAC signature verification (HS256/384/512)
JWKS endpoint verification for RSA/ECDSA/RSA-PSS
JWT encoding with payload templates
Token comparison with table and JSON diff
Identity provider detection (Auth0, Okta, Cognito, etc.)

What you can do

Decode any JWT

Paste a JSON Web Token and instantly see the decoded header and payload with claim tooltips, timestamps, and expiration status.

Verify HMAC signatures

Enter your secret key to verify HS256, HS384, or HS512 signatures and confirm the token has not been tampered with.

Verify via JWKS

Fetch the issuer JWKS endpoint and verify RS256, ES256, or PS256 signatures against the correct public key automatically.

Encode new tokens

Build a JWT from scratch with custom header and payload, then sign it with HMAC or paste your own key.

Compare two tokens

Paste two JWTs to see a structured diff of header and payload claims — added, removed, and modified fields highlighted.

Identify the issuer

The tool auto-detects tokens from Auth0, Okta, AWS Cognito, Google, Azure AD, Firebase, and Keycloak by inspecting the iss claim.

Private by design

Client-side
No sign-up
Free

JWT Debugger runs entirely in your browser tab. No data is uploaded, no server processes your input, and no account is required.

Specifications

Algorithms: HS, RS, ES, PS (256/384/512) + EdDSA (13 total)
HMAC verify: HS256, HS384, HS512
JWKS verify: RS, ES, PS (RSA-PSS), EdDSA
Max token size: 100 KB
Providers detected: Auth0, Okta, Cognito, Google, Entra ID, Firebase, Keycloak + 10 more
Processing: 100% client-side, no upload