🎟️ JWT Debugger & Signer

Using JWT Debugger & Decoder

Read the header and claims inside a JSON Web Token while debugging a login or API call, and test HS256, HS384 or HS512 signatures with a known secret.

How to use it

1. Paste the token into Encoded Token. The header and payload appear as formatted JSON on the right.
2. Check exp, iat and nbf in the payload to see whether the token has expired or is not yet valid.
3. Enter the secret under Verify & Sign Signature, ticking Secret is Base64 encoded if your server stores it that way, and read whether the signature is valid.
4. To build a test token, edit the header or payload, or click iat (now), exp +1h and similar buttons; the token is rebuilt and signed with your secret, or left with an empty signature if no secret is entered.

Worked example

Input and settings

The standard jwt.io sample token (HS256, name John Doe) checked with the secret wrong-secret

Expected result

Payload shows sub 1234567890, name John Doe, iat 1516239022; status Invalid Signature, and the pasted token is left unchanged.

Limits and common mistakes

• Anyone can read a JWT's payload: decoding it proves nothing until the signature is verified.
• Only HMAC algorithms are supported; RS256 and ES256 tokens decode but cannot be verified here.
• A valid signature does not check issuer, audience or your application's other rules.
• Tokens and secrets are never written into the page address, but still avoid pasting live production tokens into any website.

Found a mismatch? Report a problem with a non-sensitive example. Read our privacy information before sharing inputs or links.