JWT Debugger

Runs entirely in your browser. Nothing is sent anywhere — safe for internal tokens.

Encoded

Claims

Header

Signature enter a key to verify

Secret (HMAC) secret is base64url encoded

Public Key (PEM, SPKI) — used to verify

Asymmetric algorithms can only be verified here, not signed (no private key needed for verification).

alg "none" — no signature to verify. Treat tokens like this with suspicion.

Payload

Self-hosted JWT decoder/verifier · no telemetry, no external requests · source in this repo