Input
Encoded Token
Presets:
Waiting for token
Signature not checked
Private browser-based JWT inspection
JWT Debugger
Decode, inspect, verify, and create JSON Web Tokens without sending your token or secret anywhere.
Decoded
Header
{}
Decoded
Payload
{}
Claims
Timeline
Security Audit
Token Health & Vulnerability Scanner
0 Critical
1 Warning
Score 100/100
Verify
Secret or Public Key
Verification supports HS, RS, PS, and ES algorithms in the browser. EdDSA tokens can be decoded here, but are not verified by Web Crypto in this static build.
Developer Suite
Complete Token & Authentication Toolset
Everything you need to inspect, compare, generate, and verify auth tokens in your browser.
Diff
Token Diff
Compare two tokens side by side to instantly spot added, removed, or changed claims.
Compare Tokens →
Terminal
cURL Parser
Paste terminal cURL commands or raw HTTP headers to extract and decode Bearer tokens.
Extract Token →
Privacy
Payload Redactor
Sanitize and mask PII (emails, names, user IDs) before sharing tokens in Slack or tickets.
Sanitize Payload →
OIDC
JWKS Verifier
Verify tokens against public keys fetched live from remote standard JWKS endpoints.
Verify with JWKS →
Crypto
RSA & EC Key Generator
Generate disposable cryptographic public and private keypairs using Web Crypto API.
Generate Keys →
Converter
PEM ↔ JWKS Converter
Convert public keys and certificates between PEM format and JSON Web Key Sets.
Convert Keys →
OAuth 2.0
OAuth Response Inspector
Inspect bundled OAuth /token JSON responses containing access, ID, and refresh tokens.
Inspect Bundle →
Backend
Code Generator
Generate drop-in JWT verification code for Spring Boot 3, Quarkus, Node.js, and Go.
Generate Code →
JWE
JWE Inspector
Inspect RFC 7516 5-part encrypted tokens and examine headers, ciphers, and algorithms.
Inspect JWE →Educational Content
Master JWTs, OAuth 2.0 & Modern Token Security
In-depth guides, protocol comparisons, and security cheat sheets crafted to complement your development workflow.
JWT vs Session
Stateless vs stateful authentication, database hits, scaling, and token revocation tradeoffs.
OAuth vs JWT
Authorization framework vs token format. How they pair in modern API security.
ID Token vs Access Token
OIDC identity vs API permissions. Why ID tokens must never authorize backend APIs.
Refresh Token Explained
Single-use rotation (RTR), automatic reuse detection, and safe cookie storage patterns.
RS256 vs HS256
Asymmetric RSA public/private keys vs symmetric HMAC shared secrets in microservices.
JWT Attack Examples
Real-world exploit walkthroughs: alg none bypass, key confusion, brute force, and defenses.
JWT Best Practices
10 essential production rules: algorithm whitelisting, cookies, expiry, and validation.
Common JWT Errors
How to fix invalid signature, TokenExpiredError, malformed tokens, and clock drift.
JWT Cheat Sheet
Quick reference for registered claims, JOSE headers, algorithms, and CLI commands.
RFC 7519 Guide
A plain English guide to the official IETF standard, JOSE suite, and claim registries.
What It Checks
Readable claims, signature status, and token timing
Decode
Header and payload are parsed locally with helpful formatting and JSON validation.
Verify
Decode, verify, and generate JSON Web Tokens, which are an open, industry standard RFC 7519 method for representing claims securely between two parties.
Generate
Create signed tokens for testing flows, demos, and local development.