AllStoic / Developer Tools / JWT Debugger

JSON Web Token (JWT) Debugger

Decode JWT header and payload, inspect registered claims such as expiration, and verify common HMAC or RSA signatures — entirely in your browser.

🔒 Local-only · tokens and keys are not uploaded by AllStoic

JWTs can contain user or system information. This page performs decoding and verification locally with browser APIs and does not send your token or key to an AllStoic server.

Encoded JWTVerification key / secret (optional)

Paste a JWT to begin.

HEADER

—

PAYLOAD

—

CLAIMS & TOKEN STATUS

—

SIGNATURE SEGMENT

—

Decoding a JWT does not prove it is authentic. Treat claims as trusted only after validating the signature, issuer, audience and application-specific requirements.

What does a JWT debugger do?

A JSON Web Token commonly contains three Base64URL segments: a header, a payload and a signature. This tool decodes the first two segments into readable JSON and highlights common registered claims.

Claims this tool checks

The debugger highlights iss, sub, aud, jti, iat, nbf and exp. Time-based checks use your device clock, so they are diagnostic rather than a replacement for server-side authorization logic.

Signature verification

Local verification supports HMAC JWTs using HS256, HS384 and HS512, plus RSA PKCS#1 and RSA-PSS JWTs using RS256/384/512 and PS256/384/512 with a PEM public key. Other algorithms can still be decoded but are reported as unsupported for verification.

Security note

A valid signature alone is not enough to authorize a request. Applications should also enforce the expected algorithm, issuer, audience, expiry, not-before constraints and any domain-specific claims.