JWT decoder, debugger and generator

Paste a JSON Web Token to debug it: read its header and payload, see whether it has expired, and check an HS256 signature if you have the secret. Everything happens in this page: the token is never sent anywhere, and you can watch the Network tab to confirm it.

—

—

What the claims mean

Check the signature (HS256 only)

If the token uses HS256 and you have the shared secret, this checks it here in the browser. RS256 and ES256 need the issuer's public key and are not checked here.

Generate a test JWT (HS256)

Write a payload, pick a secret, and get a signed token to test your API with. Signed here with your browser's Web Crypto; nothing is sent. Use a test secret only: anyone who knows it can mint tokens your server will accept.

Things worth knowing

• A JWT is not encrypted. Header and payload are base64url text. Anyone with the token can read them, so nothing private belongs in a payload.
• A token is a credential. Treat one like a password: don't paste production tokens into sites that send them to a server, don't put them in bug reports, and rotate anything you have shared.
• alg: none means the token is unsigned. A server that accepts it accepts forgeries.
• Expiry is not revocation. Until exp passes, a stolen token still works unless the issuer keeps a deny list.