LogoSeaOtter Tools

JWT Debugger & Parser

Paste a JWT below that you'd like to decode, validate, and verify.

Algorithm

Encoded Token (Input/Output)

Paste your JWT token here...
Header
Defines algorithm
Payload
Contains claims
Signature
Verifies integrity

Header (Algorithm & Key ID)

Payload (Data & Claims)

Verify Signature

Unverified (Secret/Key Required)

Verification key is missing or incomplete.

AlgorithmHS256

How to Use the JWT Debugger & Parser

1

Paste your encoded JWT into the left editor panel. The tool will instantly split and decode the Header and Payload.

2

Check the right panel for decoded JSON. Valid claims and Unix timestamps will be parsed and formatted.

3

Optionally, input your symmetric secret or non-symmetric public key to verify the signature. Toggle Base64 encoding if needed.

4

Edit the Header or Payload JSON on the right. Enter your private key or secret to automatically re-sign and update the encoded Token on the left.

JSON Web Token Debugger FAQ

Is my JWT token uploaded to any server?
No. All encoding, decoding, and cryptographic signature verification happen entirely in your browser using the local 'jose' library and Web Crypto API. Your sensitive keys and tokens never touch the internet.
Why does my signature verification fail?
Make sure you choose the correct signing algorithm in the header (e.g., HS256 vs RS256). For HS256, make sure the secret is entered correctly and toggle 'Secret is Base64 Encoded' if the provider issued a base64-encoded secret. For RS256, make sure you paste the complete public key PEM (including BEGIN/END headers).
How can I generate a new token with modified claims?
Select the target algorithm, edit the Header and Payload JSON on the right, and input the signing key (HMAC Secret for symmetric, or Private Key PEM for RS/ES/EdDSA). The tool will automatically compile, sign, and update the JWT string on the left.
What are standard claims?
Standard claims are predefined keys in RFC 7519, such as sub (subject), iss (issuer), exp (expiration time), and iat (issued at time). They help establish standard identity and authentication metadata across different systems.

🔗 Related Tools

JSON Formatter & Validator

Format, minify and validate JSON data locally in your browser.

Universal 40-in-1 Unit Converter

Real-time, local unit converter supporting 40 domains: Physics, Development, Finance, Life, Engineering, Time & Geo.

All-in-One Crypto Suite

Supports MD5, SHA-1/256/512, AES, DES, HMAC, Base64, URL, Hex, Unicode, HTML Entity and Password Generator.

Base64 Encoder/Decoder

Encode or decode strings using standard Base64 encoding.