JWT Debugger & Encoder: What It Does
Decodes and inspects JSON Web Tokens (JWT) into header, payload, and signature components. It validates expiration (exp) and not-before (nbf) timestamps, formats JSON claims, and checks HMAC signatures.
Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6Ikpv...Header: {"alg":"HS256","typ":"JWT"}, Payload: {"sub":"1234567890"}Splits dot-separated base64url segments and parses JSON metadata.
How to Use
- Paste an encoded token into the JWT input pane.
- Inspect decoded claims, token expiration status, and algorithm header.
- Enter your HMAC secret key to verify the cryptographic signature.
Limitations
- Asymmetric RSA and ECDSA signatures require pasting the corresponding public key.
- Encrypted JWTs (JWE) cannot be inspected without their private decryption key.
Frequently Asked Questions
Can someone read claims inside a signed JWT without the secret key?
Yes. A signed JWT (JWS) is merely base64url encoded, not encrypted. Anyone can decode and inspect the payload; the secret only verifies authenticity.
What do the standard exp, iat, and nbf claims represent?
exp is token expiration time, iat is the issued-at timestamp, and nbf is the not-before timestamp, all recorded as Unix epoch seconds.
Embed or Cite JWT Debugger & Encoder
Embed this interactive utility directly into documentation or blog posts, or link via GitHub badge:
Free for Blogs & Docs<iframe src="https://filexshare.com/security/jwt-debugger" width="100%" height="650" frameborder="0" title="JWT Debugger & Encoder - FileXShare"></iframe>
<p><a href="https://filexshare.com/security/jwt-debugger" rel="nofollow">Powered by FileXShare</a></p>[](https://filexshare.com/security/jwt-debugger)Related Tools
Generate Ed25519 (recommended), RSA, and ECDSA SSH key pairs in-browser with OpenSSH authorized_keys format, PEM keys, and SHA-256 fingerprints.
Calculate IPv4 subnet masks, CIDR network address, broadcast address, and usable host ranges.
Decode X.509 certificates (PEM or DER) and Certificate Signing Requests: subject/issuer, SANs, validity, key details, extensions, and SHA-256/SHA-1 fingerprints.
Generate offline RFC 6238 TOTP codes with QR export, countdown ring, and copy-code support.