Online JWT debugger

Decode JWTs and verify HS, RS, PS, and ES signatures in the browser.

About this online JWT debugger

hidevtool JWT debugger decodes JSON Web Tokens in your browser: inspect header and payload JSON, see the signing algorithm, and optionally verify signatures with HMAC secrets or PEM public keys.

Verification runs locally—tokens and secrets are not uploaded.

Online JWT debugger capabilities

What is a JWT?

A JSON Web Token is a compact string with three Base64URL segments: header.payload.signature. It often carries claims (user id, roles, expiry) and proves integrity via a digital signature or MAC.

Three parts explained

  1. Header — JSON with typ (usually JWT) and alg (signing algorithm).
  2. Payload — JSON claims; may include registered names like sub, exp, iat.
  3. Signature — proves the token was signed with the issuer’s key; tampering breaks verification.

Common payload claims

  • sub — subject (user or client identifier).
  • exp — expiration time (Unix seconds); past exp means the token is expired.
  • iat / nbf — issued-at and not-before; useful for clock skew checks.
  • aud / iss — audience and issuer when your API enforces them.

Verification key types

  • HMAC (HS256/384/512) — paste the shared secret used to sign the token.
  • RSA / ECDSA (RS, PS, ES) — paste the SPKI PEM public key matching the private signer.

Security tips

  1. 1Never paste production secrets into untrusted sites—hidevtool runs locally, but treat keys as sensitive.
  2. 2Check exp and nbf before trusting a token; this tool shows readable times for those claims.
  3. 3alg in the header must match the key you provide; reject tokens with unexpected algorithms.
  4. 4JWTs are signed, not encrypted—anyone with the token can read the payload unless additionally encrypted (JWE).
  5. 5Rotate signing keys and use short-lived access tokens in OAuth/OIDC flows.

Common use cases

OAuth & OpenID

Inspect access or ID tokens from identity providers; verify HS or RS signatures with the configured secret or JWKS public key.

API gateways

Debug tokens rejected by Kong, NGINX, or cloud API management—compare alg, claims, and signature locally.

Session cookies

Decode session JWTs from apps to see expiry and roles without sending cookies to a server-side decoder.

Frequently asked questions

Which JWT signature algorithms can be verified?
This page can verify the following header algs in your browser (12 total): HMAC (symmetric secret): HS256, HS384, HS512 RSA PKCS#1 (SPKI PEM public key): RS256, RS384, RS512 RSA-PSS (SPKI PEM public key): PS256, PS384, PS512 ECDSA (SPKI PEM public key): ES256, ES384, ES512 Not supported: alg "none", EdDSA (e.g. Ed25519), and other algs not listed. Public keys must be SPKI PEM (BEGIN PUBLIC KEY).
How do I decode a JWT online?
Paste the token into the JWT field. Header and payload appear as formatted JSON below as soon as the structure is valid.
How do I verify a JWT signature online?
After pasting the token, enter the HMAC secret or PEM public key that matches the header alg. The tool reports whether the signature matches.
Why does verification say “none” or skip?
If alg is none or the token is malformed, verification cannot run. For HS/RS/PS/ES, supply the matching key material.
Is my JWT secret sent to hidevtool servers?
No. Decode and verify run entirely in your browser; nothing is uploaded.