JWT Debugger & Signature Validator
Decode JSON Web Tokens (JWT), inspect claims, check expiry status, and verify HMAC-SHA256 signatures.
1 How to Use the JWT Debugger & Signature Validator
Paste your encoded JWT string (header.payload.signature) into the token input box.
View automatically parsed Header and Payload formatted JSON.
Check expiration status: active, expired, or never expires.
Enter your HMAC secret key to verify the cryptographic signature live.
2 Technical Specifications
| Specification | Details & Capabilities |
|---|---|
| Specification | RFC 7519 JSON Web Token (JWT) |
| Algorithms | HS256 (HMAC-SHA256), HS384, HS512, RS256 decoder |
| Time Parsing | Epoch timestamps (exp, iat, nbf) converted to local human dates |
| Execution | 100% Client-side. Secrets never sent over network. |
Trust and Privacy
100% Client-Side Privacy Guarantee
All calculations run directly in your local browser memory. Zero data is ever transmitted, logged, or stored on remote servers.
4 Frequently Asked Questions
Q. Is it safe to paste production JWTs here?
Yes. This tool runs 100% in your local browser window. No token data, claims, or secret keys are sent to our servers.
Q. What does an expired JWT mean?
When the 'exp' claim is in the past, API servers will reject the token with HTTP 401 Unauthorized, requiring the client to refresh its session.