JWT tools
Decode · Sign · Verify · Local security
JWT tools
Ready
ABOUT
About JWT Decoder
Debug JWT authentication: decode Header/Payload, sign test tokens locally, verify signature validity.
401 Unauthorized, invalid signature, token expired—JWT issues account for a significant share of API integration tickets. Local decode and verify lets you quickly locate claims and algorithm config issues without compromising production key security.
DEEP DIVE
Learn More About JWT Decoder
JWT (JSON Web Token) consists of Header, Payload, and Signature—three Base64URL-encoded segments separated by dots. JSONSort JWT tool auto-decodes the first two as JSON, supports local signing and verification with HS256/RS256 and other algorithms—keys and tokens never leave your browser.
OAuth 2.0, OpenID Connect, and microservice auth widely use JWT. Common debugging issues: expired token (exp), issuer mismatch, signature verification failure, missing expected claims—local tools help troubleshoot quickly.
JWT Header declares alg; Payload contains time claims like exp/iat/nbf. Decoding does not verify signature—anyone can read Payload—so never store passwords or PII in JWT. Verification confirms the token is unmodified and signed by the key holder.
FEATURES
Core capabilities
Token decode
Paste JWT to auto-decode Header and Payload as formatted JSON.
Local signing
Fill in payload and secret to generate signed JWT for testing.
Signature verification
Verify token signature validity; supports HS256 and RS256.
Claims highlight
Standard claims like exp, iat, sub displayed in formatted view.
Key security
HMAC secrets and RSA private keys used only in local JavaScript.
Instant feedback
Re-decode/verify immediately when token or key changes.
Three-panel layout
Header / Payload / Signature shown separately—clearly maps to JWT structure.
Expiry indicator
Parse exp and compare with current time—shows expiry status at a glance.
HOW TO USE
How to use
-
1
Paste JWT token to auto-decode
-
2
Or fill in Payload and secret to sign/verify
-
3
Copy results—keys never leave your browser
-
4
Confirm secret and algorithm (HS256 / RS256) match the issuer
-
5
Clear test secrets and tokens from input after debugging
WORKFLOW
Typical workflow
End-to-end workflow from import to export, helping teams standardize JWT Decoder usage.
Paste token
Copy JWT from Authorization header, Cookie, or logs.
Check claims
Confirm sub, aud, exp, roles, etc. match expectations.
Verify (optional)
Enter secret or PEM public key to verify Signature validity.
Sign test token
Modify Payload and sign locally—for unit tests or mock gateways.
USE CASES
Use cases
Backend developers
Debug auth middleware; verify signed token structure is correct.
Frontend developers
Parse roles/permissions claims in Access Token.
Security
Audit JWT for sensitive claims; verify signing algorithm compliance.
Full-stack integration
Inspect id_token and access_token contents during OIDC login flows.
Identity engineer
Debug claims differences between OIDC id_token and access_token.
Mobile
Parse refresh token structure stored in app (do not verify on production devices).
TIPS
Tips
- After pasting token, check exp first—most 401 issues are caused by expiry.
- RS256 verification requires PEM-format public key; HS256 uses shared secret string.
- Never use online tools with production keys—JSONSort local processing is the safer choice.
- When signing test tokens, avoid putting real user PII in payload.
- alg in Header must match verification algorithm, otherwise verification fails.
- Decoded Payload can be copied to Formatter to edit claims, then re-sign.
- Remove Bearer prefix—paste only the three-segment token starting with eyJ.
- Clock skew: server/local time difference may cause freshly signed tokens to appear expired.
- RS256 public key in PEM format, including BEGIN PUBLIC KEY line.
- Clear localStorage session after debugging to avoid test token residue.
LOCAL VS ONLINE
Local vs online tools
JSONSort stays purely frontend—this comparison shows why local tools fit dev data better.
TROUBLESHOOTING
Common pitfalls & fixes
Issues you may hit in practice and how to handle them—save time on trial and error.
invalid signature
Tip:Secret mismatch or alg inconsistency; confirm HS256 vs RS256.
token expired
Tip:Check exp; when debugging, sign test tokens with longer ttl.
Malformed token
Tip:Confirm three segments separated by . and Base64URL has no extra whitespace.
Public key verification failed
Tip:PEM format error; confirm JWKS public key matches iss.
FAQ
FAQ
Are keys uploaded?
No. Signing and verification run entirely in browser Web Crypto / JS.
Does it support RS256?
Supports HS256 and RS256. ES256 and others may be added later.
Can I decode without a key?
Header and Payload decode without a key. Signature verification requires a key.
Can expired tokens still be decoded?
Yes. Decoding is not limited by exp; exp only affects whether the server accepts the token.
Does decoding equal identity verification?
No. Decoding only reads content; verification confirms the token is trustworthy.
Does it support encrypted JWT (JWE)?
Currently focused on JWS (signed JWT). JWE requires dedicated decryption tools.
Is data uploaded to a server?
No. All JSONSort tools run locally in your browser—your input is never sent to any backend.
Do I need to sign up or install anything?
No. Open the page and go—no account, no client download, PWA offline cache supported.
How large can files be?
Depends on browser memory; multi-MB data usually runs smoothly. Split very large files or use merge & clean first.