JWT Debugger
Decode, encode, and verify a JSON Web Token in this tab.
Algorithm: HS256
Header · Payload · Signature
Valid JWT
Enter a secret to verify HMAC, or a PEM public key for RS256.
How it works
Paste the encoded token
Use the decoder tab. Header and payload appear as you type. Orange is the header, purple is the payload, green is the signature. Pink dots separate the parts.
Check the signature
HMAC tokens need the shared secret. Tick Base64URL if the secret is encoded that way. RS256 needs a PEM public key. Claims are untrusted until the signature verifies.
Encode or copy
Switch to the encoder tab to edit JSON and sign with HS256, HS384, HS512, or none. Copy sits on each field label. Generate example loads a sample token.
What is a JWT?
A JSON Web Token is three Base64URL parts joined by dots: header, payload, and signature. The header names the algorithm. The payload holds claims such as sub, iat, and exp. The signature is HMAC or public-key crypto over the first two parts. This debugger decodes the JSON, signs HS256, HS384, and HS512, and verifies those plus RS256 with a PEM public key. It runs in the tab. Easy24 does not receive the token.
Why use this tool
- JWT Debugger runs in a browser tab.
- Live decode, HMAC sign, and signature check
- Color-coded header, payload, and signature
- No account. Unlimited on the free plan
Questions
What is a JWT?
A JSON Web Token has three parts: header, payload, and signature. Apps use them for login and account access.
How do I use JWT Debugger?
Paste a token on the decoder tab. Header and payload update as you type. Enter the HMAC secret or a PEM public key to check the signature. Copy sits on each field label.
Decoder or encoder?
Decoder reads a pasted token and can verify it. Encoder lets you edit header and payload JSON, then signs a new HMAC token. Generate example fills both with a sample.
Does it verify signatures?
Yes for HS256, HS384, and HS512 with the shared secret. RS256, RS384, and RS512 verify if you paste a PEM public key. ECDSA and other algorithms decode only. A decoded payload is not proof the token is genuine.
What do the colors mean?
Orange is the header, purple is the payload, green is the signature. Pink dots sit between the parts. The same colors appear in the encoded token field.
What is Claims breakdown?
It lists each JSON key and value. iat, nbf, and exp also show as UTC dates. Switch back to JSON to edit on the encoder tab.
What is alg none?
The header says the token is unsigned. There is no signature to check. This format should not be trusted for real user sessions.
Is a JWT encrypted?
No. Header and payload are only Base64URL encoded. Anyone who has the token can read the claims. The signature proves they were not changed, if it verifies.
Is my token sent to a server?
No. Decode, encode, and verify run in this tab. Easy24 does not receive the token or the secret.
Is there a daily limit?
No. There is no daily cap on this tool.
Do I need an account?
No. Open the page and use it.
Does it work on a phone?
Yes. It runs in the mobile browser.
If Easy24 helped, buy a coffee
Tools stay free in your browser. One-time thanks via Kreosus. Turkish cards work.
Similar Security tools
See allHash Generator
Security
MD5, SHA-1, SHA-256, SHA-384, or SHA-512 of UTF-8 text. Hex or Base64. Compare a known digest.
OpenHTTP Basic Auth
Security
Build or parse an Authorization: Basic header from a username and password.
OpenCaesar Cipher
Security
Shift Latin letters by a chosen amount. ROT13 is shift 13.
Open