Free JWT debugger — decode & verify JSON Web tokens privately
Related Tools
Regex tester online with Go RE2, bash/grep, sed -E, Perl, and C# flavor guides — live matches in your browser.
Free online cron builder: translate schedules to plain English, validate syntax, and preview next runs.
Generate secure UUID v4, ULID, and NanoID identifiers in bulk.
Number to words online, A1Z26 letter–number cipher, and phone keypad vanity mapping — all in your browser.
Convert between Unix epoch timestamps and human-readable dates across time zones.
Generate Discord dynamic t: timestamps from Unix epoch — copy default, full, relative, time, or date styles.
About Free JWT debugger — decode & verify JSON Web tokens privately
JWT Debugger decodes and verifies JSON Web Tokens without ever sending them to a server. Paste a token to see the header and payload pretty-printed, inspect standard claims (exp, iat, nbf), and verify HS256/HS384/HS512 signatures with your shared secret using the Web Crypto API.
A private alternative to jwt.io
jwt.io is the most well-known JWT decoder, but it sends your token to a remote server for processing. If your token contains user IDs, email addresses, or role claims from a production system, that is a security risk. AllOneTools JWT Debugger decodes and verifies entirely in your browser via the Web Crypto API — your token never leaves your device.
Key Features
- Decode header and payload with JSON pretty-printing
- Verify HS256, HS384 and HS512 signatures via Web Crypto
- Human-readable iat / exp / nbf timestamps
- Expired and not-yet-valid warnings
- Zero network calls — token and secret stay in your browser
- Copy-ready token input for quick sharing with teammates
Use Cases
- Debug authentication flows while building web and mobile apps
- Inspect tokens returned by Auth0, Firebase, AWS Cognito, Keycloak
- Verify that refresh tokens are still within their expiry window
- Teach the structure of JWTs to junior engineers safely
- Compare two tokens to find why one is being rejected upstream
Pro Tips
- Never paste a production JWT into any online decoder you do not trust — this tool keeps tokens local, but always double-check the URL.
- JWTs are signed, not encrypted. Treat the payload as public.
- Rotate HMAC secrets regularly and store them in a secret manager, not source control.
- Set short expirations (exp) and implement refresh tokens for longer sessions.
- Include kid in the header to make key rotation painless on the server side.
Frequently Asked Questions
Does this JWT debugger send my token anywhere?
No. Decoding and signature verification use the Web Crypto API locally. No network request is made with the token or the secret.
Which algorithms can be verified in the browser?
HS256, HS384 and HS512 are fully supported today. RS256 and ES256 require public keys and will be added as an opt-in flow. For now, the tool will clearly say when an algorithm is not supported client-side.
What does each standard JWT claim mean?
iss = issuer, sub = subject, aud = audience, exp = expiration time (Unix seconds), nbf = not valid before, iat = issued at, jti = unique JWT ID. Custom claims live alongside these.
My signature is invalid — what should I check first?
Check that the secret matches exactly (no trailing newline), the algorithm in the header matches what your server expects, and that whitespace was not introduced when you copied the token.