JWT Debugger decodes and inspects JSON Web Tokens — parsing header, payload, and signature, displaying claims, and flagging expiry status. Perfect for debugging authentication issues, inspecting OAuth/OIDC tokens, and verifying JWT content without running a separate decoder or hitting jwt.io.
JWT (JSON Web Token) is the dominant format for auth tokens across modern APIs — OAuth, OIDC, session tokens, and custom API auth. But a JWT looks like gibberish: three Base64URL-encoded strings joined by dots. JWT Debugger parses that string into its three parts — header (algorithm metadata), payload (the claims), and signature — decodes each, and displays the JSON contents with syntax highlighting. The payload is parsed for known claims: iss (issuer), sub (subject), exp (expiry), iat (issued at), nbf (not before), aud (audience), jti (token ID). Expiry is converted from Unix timestamp to human-readable form and flagged as valid, expired, or not yet valid. The tool does NOT verify the signature — signature verification requires the secret key and is out of scope for a client-side tool — but it shows you exactly what a token contains so you can debug auth issues quickly.
Splits the JWT on dots and Base64URL-decodes each segment: header, payload, and signature. Each is shown separately with syntax highlighting.
Displays the algorithm (HS256, RS256, ES256) and token type. Quickly verify what signing scheme a service is using.
Parses the JSON payload and renders it with color-coded keys, strings, numbers, and booleans. All claims are visible at a glance.
Checks the exp (expiry), iat (issued at), and nbf (not before) timestamps. Flags whether the token is valid, expired, or not yet active — with human-readable times.
Recognizes registered claims (iss, sub, aud, exp, iat, nbf, jti) and provides quick-reference annotations for their meaning.
The raw token is shown with each segment in a distinct color so you can visually distinguish header, payload, and signature.
When an API returns 401 Unauthorized, paste the token to check if it's expired, malformed, or issued by the wrong issuer.
Decode access tokens and ID tokens returned from OAuth/OIDC flows to see granted scopes, user identity, and expiry.
Confirm that required claims (roles, permissions, tenant ID) are present in the token before assuming the backend will accept it.
When a token is generated by a backend service, decode it to verify the payload matches what the service intended to issue.
During a security review, decode tokens stored in localStorage or cookies to assess what sensitive data is being exposed client-side.
Click the JWT icon in the DevSuite Pro dock. A panel opens with a token input field and three decoded panes.
Paste any JWT — from an API response, Authorization header, cookie, or localStorage. Include or omit the "Bearer " prefix; both work.
The Header pane shows the algorithm and type. Confirm it's using the scheme your backend expects (often HS256 or RS256).
The Payload pane shows all claims with syntax highlighting. Standard claims (iss, sub, exp) are flagged with their purpose.
The status badge shows Valid, Expired, or Not Yet Valid. If expired, the token is probably why your auth is failing.
Installer DevSuite Pro gratis og lås op for 39+ udviklerværktøjer til din browser.
