JWT Debugger & Inspector
The JWT Debugger decodes JSON Web Tokens, displays header and payload claims, checks expiration timestamps in real time, and verifies HMAC signatures locally using the browser's native WebCrypto API. 100% private with zero data sent over the network.
Verifies HMAC signatures (HS256, HS384, HS512) locally using the browser's native WebCrypto API. Secret is never uploaded.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "usr_1289402",
"name": "Alex Vankova",
"email": "[email protected]",
"role": "admin",
"iat": 1738419600,
"exp": 2087164400,
"iss": "https://auth.thecybertools.com/"
}665pBkWv2L9gJ5l8HjL4c8v10Z5b31Z5T9e2D1w8K60
JSON Web Tokens (JWT) are the standard for modern API authentication and OAuth2/OIDC sessions. This debugger lets you inspect headers, examine payload claims, check expiration countdowns, and cryptographically verify signatures using WebCrypto — entirely inside your browser with zero network calls.
How to use the JWT Debugger & Inspector
- Paste your encoded JWT into the token area.
- Inspect the auto-formatted Header and Payload JSON on the right.
- Check live claim badges for expiration (exp), issue time (iat), and activation (nbf).
- Enter an HMAC secret key to verify the signature locally.
Common use cases
- Debug OAuth2 / OIDC authentication tokens from Auth0, Okta, or Supabase.
- Verify token expiration and standard registered claims during API development.
- Inspect microservice role-based access control (RBAC) scopes and user attributes.
- Verify HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512 signatures without exposing keys.
Tips
- Never paste production JWTs or API keys into online tools that upload to external servers — this debugger runs 100% locally via WebCrypto.
- An expired token will be rejected by backend API gateways regardless of whether its signature is mathematically valid.
Frequently asked questions
Is my token or secret key sent to a server? +
No. All decoding and cryptographic signature verification happen entirely in your browser using the native WebCrypto API (crypto.subtle). Zero bytes leave your machine.
Which signature algorithms are supported? +
The debugger supports HMAC algorithms (HS256, HS384, HS512) for local signature verification using your shared secret, as well as decoding tokens signed with RS256, ES256, and EdDSA.
Can a JWT be decoded without a secret key? +
Yes. JWT headers and payloads are Base64URL-encoded, not encrypted. Anyone can decode and read the claims. The signature ensures the claims have not been tampered with.