JWT Debugger
Decode, inspect, verify, and generate RFC 7519 JSON Web Tokens in real-time. Verify HMAC (HS256/384/512) and RSA signatures in browser memory with zero server uploads.
RFC 7519 JWT Inspector
In-Browser JSON Web Token Inspection and Cryptographic Verification
The JWT Debugger decodes, inspects, and verifies JSON Web Tokens directly within your web browser. By utilizing the native W3C Web Crypto API, token segments are parsed into structured JSON objects and evaluated for cryptographic signature validity in local memory without transmitting credentials or private keys to external servers.
JSON Web Tokens adhere to the RFC 7519 open standard, encapsulating claims across three dot-separated Base64URL segments: the JOSE Header (RFC 7515), the Payload Claims, and the Cryptographic Signature (RFC 7518). The debugger validates standard registered claims including expiration time (exp), not-before time (nbf), and issued-at time (iat), calculating elapsed and remaining validity durations automatically.
This utility features a color-coded three-part segment inspector, synchronized dual-way JSON editors for modifying claims on the fly, pre-configured authentication presets, and hardware-accelerated signature verification for HMAC (HS256, HS384, HS512) and RSA (RS256, RS384, RS512) algorithms.
Core Tool Capabilities
- Color-Coded Token Segmentation: Visually decomposes encoded token strings into distinct header, payload, and signature segments with synchronized color highlighting for rapid visual debugging.
- Web Crypto Signature Verification: Verifies HMAC (HS256, HS384, HS512) and RSA (RS256, RS384, RS512) signatures natively in browser memory using SubtleCrypto without exposing private keys over the network.
- Automated Claim Timeline Analysis: Translates raw Unix timestamps into formatted UTC dates and computes live expiration statuses to identify expired or future-dated tokens instantly.
- Dual-Way Live JSON Editing: Modify decoded header or payload claims directly in the structured JSON editor to recalculate signatures and generate freshly encoded token strings.
- Local Memory Security: Executes all string manipulation and cryptographic hashing strictly in volatile client memory with zero server telemetry or persistent storage.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • OAuth 2.0 and OIDC Session Debugging
- • Microservice Token Verification
- • Token Expiration and Skew Diagnostics
- • Payload Tamper and Signature Testing
Technical Specifications & Platform Limits
Standard RFC 7518 cryptographic signature and digest suites.
Full compliance with IETF JOSE token and signature specifications.
Browser-native hardware-accelerated cryptographic primitives.
Processes token strings locally with zero network transmission.
Step-by-Step Workflow
Paste Encoded Token
Paste your raw dot-separated JSON Web Token string into the input area or select a sample authorization preset.
Inspect Decoded Claims
Review the decoded Header and Payload JSON structures to inspect user claims, scopes, and automated expiration timestamps.
Verify Signature Authenticity
Enter your shared secret key or paste an RSA Public Key in SPKI PEM format to cryptographically verify signature validity.
Modify and Re-Sign
Edit JSON claims in the right panel to test modified payloads and copy the updated Base64URL token string.
Practical Real-World Use Cases
OAuth 2.0 and OIDC Session Debugging
Backend developers inspecting claims, scopes, tenant identifiers, and expiration timestamps on incoming authorization bearer tokens.
Microservice Token Verification
DevOps and API engineers testing whether inter-service gateway tokens pass signature validation with configured shared secrets.
Token Expiration and Skew Diagnostics
Fullstack developers troubleshooting premature session logouts by checking time differences across exp, nbf, and iat claims.
Payload Tamper and Signature Testing
Security analysts verifying that modifying a single character in the payload causes signature verification to fail as expected.
Frequently Asked Questions
- Are my bearer tokens or secret keys sent to an external server?
- No. All token decoding, claim parsing, and cryptographic signature verifications occur exclusively within your web browser using native JavaScript and Web Crypto APIs.
- Which signature algorithms can the debugger verify locally?
- The debugger supports HMAC-SHA256 (HS256), HMAC-SHA384 (HS384), and HMAC-SHA512 (HS512) using raw secret strings, as well as RS256, RS384, and RS512 using standard SPKI public key PEM blocks.
- How does the debugger evaluate token expiration?
- The tool extracts the numeric Unix timestamp from the exp claim, compares it against the client system clock, and displays whether the token is currently valid or expired alongside the exact remaining or elapsed time.
- Can I edit payload claims and generate a newly signed token?
- Yes. Editing the JSON text in the payload editor automatically updates the encoded Base64URL string and re-computes the HMAC signature if a secret key is provided.
- Why does signature verification fail when the payload looks correct?
- Signature verification requires both the exact shared secret key and the precise original Base64URL byte sequence. Even minor differences in whitespace, character encoding, or key strings will result in a signature mismatch.
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind JWT Debugger - Decode, Inspect, and Verify JSON Web Tokens with our deep-dive educational content.