JWT Debugger
A JWT debugger is a web-based tool that decodes JSON Web Tokens (JWTs) into human-readable header and payload JSON objects, displays registered and private claims, highlights expiration and not-before timestamps, and helps developers inspect authentication and authorization tokens without sending sensitive credentials to remote servers.
Paste your JWT string into ScanSuite's free JWT debugger to instantly decode the Base64URL-encoded header and payload sections, view formatted JSON claims including exp, iat, sub, and aud, inspect the signature segment, and copy individual sections for API debugging — all processing happens locally in your browser.
Introduction to JSON Web Token Debugging
JSON Web Tokens (JWTs) have become the de facto standard for stateless authentication and authorization in modern web applications, single-page apps, and microservice architectures. A JWT compactly encodes identity claims, permissions, and metadata into a three-part Base64URL string separated by dots: header.payload.signature.
ScanSuite's free online JWT debugger provides instant decoding and inspection of JWT tokens directly in your browser. Whether you are debugging OAuth 2.0 access tokens from Auth0, Okta, or AWS Cognito, inspecting session tokens in a React application, or validating API gateway bearer tokens, this tool decodes header and payload sections into formatted JSON with syntax highlighting and one-click copy functionality.
JWT structure
A JWT debugger (also called a JWT decoder or JWT parser) is a developer utility that splits a JSON Web Token into its constituent parts and Base64URL-decodes the header and payload segments into readable JSON. Unlike a full JWT validator, a debugger focuses on visibility — surfacing claims, algorithm metadata, and token structure for development and troubleshooting workflows.
JWTs are defined in RFC 7519 and consist of a JOSE header (typically specifying the signing algorithm like HS256 or RS256), a payload containing registered claims (iss, sub, aud, exp, nbf, iat, jti) and custom application claims, and a cryptographic signature or MAC that binds the first two segments together. A debugger reveals all of this structure without requiring command-line tools like `jwt decode` or manual Base64 decoding.
Why Use an Online JWT Debugger?
Developers frequently encounter opaque bearer tokens in HTTP Authorization headers, browser localStorage, cookie values, and API response bodies. When authentication fails with 401 Unauthorized or token validation errors, the first diagnostic step is decoding the token to inspect claims like expiration (exp), audience (aud), issuer (iss), and scopes.
Using a browser-based JWT debugger eliminates the need to install JWT CLI utilities, write one-off Node.js scripts, or paste tokens into untrusted third-party services that may log sensitive credentials. ScanSuite processes tokens entirely client-side, ensuring your production access tokens, refresh tokens, and API keys never leave your session.
Who Uses JWT Debuggers?
Frontend and full-stack developers use JWT debuggers to inspect access tokens returned by OAuth providers, verify that the correct scopes and user IDs are embedded in token payloads, and troubleshoot Single Sign-On (SSO) integration issues during development.
Backend engineers and API developers decode JWTs to verify claim structures match their authorization middleware expectations, confirm token expiration aligns with session timeout policies, and debug mismatches between expected and actual audience or issuer values.
Security engineers and penetration testers inspect JWT headers for algorithm confusion vulnerabilities (such as alg:none attacks), weak signing algorithms, and excessive token lifetimes during security assessments and code reviews.
How verification works
This page decodes the three segments and can HMAC-sign a token you edit. It does not check a signature against a secret. Verification means recomputing the signature with the same key and comparing it; that check belongs on the server that holds the key.
When you paste a JWT into the debugger, the tool splits the compact serialization on period (.) delimiters into exactly three segments. The first segment is Base64URL-decoded to reveal the JOSE header JSON object containing fields like alg (signing algorithm) and typ (token type). The second segment decodes to the payload JSON containing all registered and custom claims.
The third segment is the signature — a cryptographic output produced by signing the encoded header and payload with a secret key (HMAC algorithms like HS256) or private key (RSA/ECDSA algorithms like RS256 and ES256). While the debugger displays the raw signature bytes, actual signature verification requires the corresponding secret or public key and is performed server-side in production systems.
Decoding a Standard OAuth Access Token
Input Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Decoded Header: { "alg": "HS256", "typ": "JWT" }
Decoded Payload: { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
The sub claim identifies the subject user, iat records when the token was issued, and the signature segment validates integrity using the HMAC-SHA256 shared secret.
Inspecting Token Expiration Claims
A payload containing "exp": 1735689600 indicates the token expires at that Unix timestamp. Cross-reference with the Timestamp Converter to see the human-readable expiration date.
If your API returns 401 errors, check whether exp has passed, whether nbf blocks early usage, and whether the clock skew between issuer and validator exceeds your tolerance window (typically 30–60 seconds).
JWT Signing Algorithm Comparison
| Algorithm | Key Type | Use Case | Security Level | |
|---|---|---|---|---|
| HS256 | HMAC-SHA256 | Shared Secret | Monolithic apps, microservices with shared keys | Good with strong secrets (256+ bits) |
| RS256 | RSA-SHA256 | Public/Private Key Pair | OAuth providers, multi-tenant SaaS, JWKS validation | Industry standard for distributed systems |
| ES256 | ECDSA P-256 | Elliptic Curve Key Pair | Mobile apps, IoT, performance-sensitive environments | Strong security with smaller key sizes |
| PS256 | RSA-PSS SHA-256 | Public/Private Key Pair | High-security financial and government systems | Recommended over RS256 for new implementations |
Common errors
Ensure the token has exactly three dot-separated segments. JWE encrypted tokens have five segments and require a decryption tool instead of a standard debugger.
Verify the token uses Base64URL encoding (replacing + with -, / with _, and omitting padding). Standard Base64-encoded strings will fail to decode correctly.
Check for accidental whitespace, line breaks, or missing Bearer prefix — the debugger expects the raw JWT string without the Authorization scheme prefix.
Why Do My API Claims Look Wrong?
Some identity providers nest custom claims under a namespace URI (e.g., https://example.com/roles). Expand nested objects in the JSON viewer to locate application-specific claims.
Confirm you are decoding the access token rather than the ID token — OAuth flows issue both, and they contain different claim structures and validation requirements.
Related tools
- Encoder & Decoder — Base64, URL encode/decode
- URL Parser — Parse & analyze URLs
- Hash Generator — Compute HMAC-SHA256 signatures for JWT token testing.
- Encoder Decoder — Base64URL encode and decode JWT token segments.
- Password Generator — Generate strong secrets for HS256 JWT signing keys.
- Timestamp Converter — Convert JWT exp and iat Unix timestamps to readable dates.
- CSP Generator — Build Content Security Policy headers to protect against XSS token theft.
Frequently Asked Questions
How do I convert JWT exp and iat times to a date?
`exp`, `iat` and `nbf` are Unix timestamps in seconds. The debugger shows each one as a readable date in your timezone and flags expired tokens. You can also paste the number into the epoch converter.
How do I decode a JWT?
Paste the token. Its three dot-separated parts are the header, the payload and the signature. The header and payload are Base64URL-encoded JSON and are decoded instantly. Decoding does not need the secret.
Can this tool verify a JWT signature?
It can decode any JWT and create new HS256/HS384/HS512 tokens with a secret you enter. It does not compare a pasted token's signature against a key to prove the original token is valid. Always check `exp`, `aud` and `iss` in your own code as well.
Is it safe to paste a JWT here?
Decoding happens in your browser and tokens are not sent to our servers. Even so, do not paste live production tokens into any online tool, because anyone holding a valid token can use it until it expires.
Why is my JWT invalid or expired?
The usual causes are an `exp` time that has passed, clock skew between servers, the wrong secret or key, an algorithm mismatch (HS256 vs RS256), or a token that was changed or cut short when copying.
What is a JWT debugger?
A JWT debugger is a tool that decodes JSON Web Tokens into readable header and payload JSON, allowing developers to inspect authentication claims, expiration timestamps, and token structure during development and troubleshooting.
Is it safe to paste production JWT tokens into an online debugger?
Only use client-side debuggers like ScanSuite that process tokens locally in your browser. Avoid services that send tokens to remote servers, as decoded payloads often contain sensitive user data and credentials.
What are the three parts of a JWT?
A JWT consists of a header (algorithm and token type), a payload (claims and metadata), and a signature (cryptographic proof of integrity). The three Base64URL-encoded segments are separated by dots.
Can a JWT debugger verify token signatures?
A debugger displays the signature segment but full verification requires the signing secret (for HMAC) or public key (for RSA/ECDSA) and should always be performed server-side in production applications.
What is the difference between decoding and validating a JWT?
Decoding reveals the header and payload contents by reversing Base64URL encoding. Validating additionally verifies the cryptographic signature, checks expiration, and confirms issuer and audience claims match expected values.
What does the exp claim mean in a JWT?
The exp (expiration time) claim is a NumericDate timestamp indicating when the token becomes invalid. Validators must reject tokens where the current time exceeds the exp value.
What is the alg:none vulnerability?
The alg:none attack occurs when an attacker modifies the JWT header algorithm to none, removing signature verification. Servers must whitelist allowed algorithms and never accept unsigned tokens in production.
How do I decode a JWT in the browser without a tool?
Split the token on dots, Base64URL-decode the first two segments, and parse the result as JSON. ScanSuite automates this process with formatting, syntax highlighting, and claim inspection.
What is the difference between an access token and an ID token?
Access tokens authorize API requests and contain scopes and permissions. ID tokens authenticate the user's identity and contain profile claims like name and email. Both use JWT format but serve different purposes in OAuth 2.0 flows.
Why does my JWT have five segments instead of three?
A five-segment token is a JWE (JSON Web Encryption) token, which encrypts the payload for confidentiality. Standard JWT debuggers decode three-segment JWS (JSON Web Signature) tokens only.
What registered claims should I always include in JWTs?
Production JWTs should include iss (issuer), sub (subject), aud (audience), exp (expiration), and iat (issued at) claims at minimum. Add jti (JWT ID) for replay prevention in high-security contexts.
How long should JWT access tokens be valid?
Industry best practice recommends short-lived access tokens of 5 to 15 minutes, combined with refresh tokens for session continuity. Long-lived tokens increase the impact of token theft or leakage.
Can I edit JWT claims in the debugger?
Yes. ScanSuite allows in-place editing of header and payload JSON for local development testing. Note that modifying claims invalidates the original signature unless you re-sign with the correct secret or private key.
What is Base64URL encoding?
Base64URL is a URL-safe variant of Base64 encoding used in JWTs. It replaces + with -, / with _, and omits padding equals signs, making tokens safe for use in HTTP headers and URL query parameters.
How do refresh tokens differ from access tokens?
Refresh tokens are long-lived credentials used solely to obtain new access tokens from the authorization server. They should be stored securely, rotated on each use, and never sent to resource APIs.
What is a JWKS endpoint?
A JSON Web Key Set (JWKS) endpoint publishes public keys used to verify RS256 and ES256 JWT signatures. OAuth providers like Auth0 and Okta expose JWKS URLs for automatic key rotation support.
Does ScanSuite store or log my JWT tokens?
No. All decoding happens entirely in your browser using client-side JavaScript. Tokens are never transmitted to ScanSuite servers, logged, or persisted in any storage.
What causes Invalid JWT format errors?
Common causes include missing dot separators, extra whitespace, truncated tokens, standard Base64 instead of Base64URL encoding, or attempting to decode a JWE five-segment encrypted token with a JWS decoder.
Should I use HS256 or RS256 for my application?
Use RS256 (asymmetric) when multiple services verify tokens or when using third-party identity providers with JWKS. Use HS256 (symmetric) only in trusted monolithic environments with strong shared secrets managed via secure vaults.
How do I check if my JWT has expired?
Decode the token and compare the exp claim (Unix timestamp) against the current time. ScanSuite highlights expiration claims automatically. Use the Timestamp Converter to translate exp values into readable dates.
Summary
ScanSuite's free online JWT debugger instantly decodes JSON Web Tokens into formatted header and payload JSON with syntax highlighting, claim inspection, and editable re-encoding for development testing. All processing runs client-side in your browser, keeping sensitive authentication tokens private while you debug OAuth flows, API authorization, and token expiration issues.