🎫JWT Debugger
Loading...
JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties. This tool combines a decoder and generator into a single JWT debugger. You can analyze existing tokens or generate test tokens and decode them immediately.
How to Use
- 1Select a Tab
Choose 'Decoder' or 'Generator' from the tabs at the top.
- 2Decode a JWT
In the Decoder tab, paste a JWT token and the header, payload, claims, and signature are analyzed automatically.
- 3Generate a JWT
In the Generator tab, configure the algorithm, secret key, and claims to auto-generate a token.
- 4Bridge to Decoder
Click 'Decode this token' on a generated token to switch to the Decoder tab with the token pre-filled.
Tips
- 💡JWT decoding doesn't require a secret key. The payload is encoded, not encrypted — never put sensitive information in the payload.
- 💡Check the expiration (exp) claim to quickly determine if a token is still valid.
- 💡When debugging API authentication errors, inspecting token claims often reveals the root cause.
- 💡This tool does not verify signatures. Signature verification must be done server-side with the secret key.
FAQ
- Q. What are the three parts of a JWT?
- A. A JWT consists of a Header (algorithm and token type), a Payload (claims such as user ID and expiry), and a Signature (generated with a secret key). Each part is Base64URL-encoded and separated by dots.
- Q. Can the payload be decoded without a secret key?
- A. Yes. The header and payload are only Base64URL-encoded, not encrypted, so anyone can decode them. Only the signature requires the secret key to verify. Never store sensitive information in a JWT payload.
- Q. What are the trade-offs between JWT and session cookies?
- A. JWT is stateless, making it easy to scale horizontally, but revoking a token before it expires is difficult. Sessions are stateful, allowing instant logout, but require server-side storage or a shared session store.
- Q. What expiry time should I set for a JWT?
- A. Access tokens typically expire in 15 minutes to 1 hour. Refresh tokens last 7–30 days. Shorter-lived tokens are more secure. Use refresh tokens to silently renew access tokens without re-authentication.