JWT Advanced Debugger

How do I decode and verify a JWT safely without uploading it?

AnyTool's JWT Advanced Debugger decodes, verifies, forges and security-audits JSON Web Tokens entirely in your browser. Paste a token to see its header, payload and claims with a live expiry countdown, then verify signatures with a secret or public key on the native WebCrypto API. Your token never leaves your device.

Live decode-as-you-type with colored header, payload and signature segments
Verify HS256/384/512 secrets or RS/PS/ES/EdDSA public keys via PEM, JWK or JWKS
Security lint flags alg:none, algorithm confusion, weak secrets and injection
100% in your browser - no upload, no signup, works offline

What is

JWT Debugger

A JWT debugger is a tool that decodes a JSON Web Token into its header, payload and signature, validates its claims and expiry, and verifies or signs the token using a secret or cryptographic key.

Developer Tools

Related terms

JSON Web TokenSignature VerificationClaims ValidationWebCrypto

Frequently Asked Questions

Yes. AnyTool's JWT Advanced Debugger is 100% client-side, with no backend, upload or runtime CDN. Decoding uses native browser APIs and verification or signing runs on WebCrypto via the jose library, so your tokens, secrets and private keys never leave the tab.

Yes. Decoding, verifying and signing all run locally in your browser, so the token and keys never leave your device.

The Security tab runs a live lint that highlights risky token shapes most decoders ignore: the insecure alg:none flag, RS256-to-HS256 algorithm confusion, weak or short HMAC secrets, missing or far-future expiry, and header-injection vectors like kid, jku, x5u and jwk. These are heuristics that flag risky shapes, not confirmed server vulnerabilities.

It flags alg:none, RS-to-HS algorithm confusion, weak HMAC secrets, missing exp, over-long lifetimes and kid/jku/x5u/jwk injection.

Because the tool never uses a backend proxy, fetching an arbitrary JWKS URL from the browser is usually blocked by CORS. The reliable path is to paste the JWK or JWKS document directly, which the verifier accepts alongside PEM SPKI or X.509 keys. EdDSA support also depends on the browser's WebCrypto implementation.

Not reliably. Most JWKS endpoints block browser fetches with CORS, so the tool is paste-first for JWK and JWKS JSON.

Paste your token into the input, then open the Verify tab. For HS256/384/512 enter the shared secret; for RS, PS, ES or EdDSA paste a PEM public key, a JWK or a full JWKS document. Verification runs live on WebCrypto and shows a clear valid or invalid badge as you edit the token or key.

Paste the token, open the Verify tab, and supply the HMAC secret or paste a PEM, JWK or JWKS public key.

Decode, verify, forge and security-audit JSON Web Tokens live in your browser, with a security lint, expiry countdown and copy-as-code snippets.

Features

Live decode of header, payload and signature with pretty syntax-highlighted JSON
Standard-claims panel with human-readable exp, iat and nbf plus a ticking expiry countdown
Verify HS256/384/512 secrets or RS/PS/ES/EdDSA keys via PEM, JWK or JWKS on WebCrypto
Sign and forge tokens from an editable header and payload, with local key-pair generation and alg:none demo
Security lint, claim-by-claim diff and copy-as-code snippets for curl, fetch and Python

PriceFree

CategoryDeveloper Tool

PlatformAll (browser-based)

PrivacyData never leaves your device

Input: JWT (compact), PEM (SPKI/X.509/PKCS8), JWK, JWKS

Output: Decoded JSON, Signed JWT, Code snippet (curl/fetch/Python)

Detailed Explanation

How It Works

What the JWT Advanced Debugger does

AnyTool's JWT Advanced Debugger decodes a JSON Web Token into its header, payload and signature, parsing them live as you type with syntax-highlighted JSON and colored base64url segments. It reads standard claims in human-readable form with a ticking expiry countdown for exp, iat and nbf, and can verify signatures, sign new tokens, run a security audit and diff two tokens. Decoding uses native browser APIs while verification and signing run on the WebCrypto API through the jose library.

Decode-as-you-type for header, payload and signature with no upload
Live expiry countdown and human-readable exp, iat and nbf claims
Verify, sign, security-lint and diff tabs in one page

Technical Details

Verifying and signing JWTs on WebCrypto

Verification supports HMAC algorithms HS256, HS384 and HS512 with a shared secret, and asymmetric algorithms RS, PS, ES and EdDSA with a public key pasted as PEM SPKI/X.509, a JWK or a full JWKS document. The Sign tab forges a token from an editable header and payload, can generate an asymmetric key pair locally, and can emit an insecure alg:none token to test that a verifier rejects it. All cryptographic operations run in the browser through jose on the native WebCrypto API.

HS256/384/512 verify with secret; RS/PS/ES/EdDSA verify with PEM, JWK or JWKS
Forge tokens from editable header and payload, plus local key-pair generation
alg:none mode produces an unsigned token for verifier testing

Limitations

Honest client-side limits

Because the tool never uses a backend proxy, fetching an arbitrary JWKS or issuer URL from the browser is frequently blocked by CORS, so the reliable path is to paste the JWK or JWKS JSON directly. The security lint reports heuristics that flag risky token shapes such as alg:none, algorithm confusion, weak secrets and kid/jku/x5u/jwk injection, not confirmed server vulnerabilities. EdDSA support also depends on the browser's WebCrypto implementation and degrades gracefully when unavailable.

JWKS-URL fetch is CORS-limited; paste JWK or JWKS JSON instead
Security findings are heuristics, not confirmed vulnerabilities
EdDSA availability depends on the browser WebCrypto support

AnyTool JWT Advanced Debugger vs typical online JWT tools
Capability	AnyTool	Typical alternative
Privacy / no upload	Yes - 100% client-side on WebCrypto	Often vendor funnel or server-side
Security lint (alg:none, confusion, weak secret, injection)	Yes - built-in live audit	Usually missing or pentester-only
Verify and sign breadth	HS/RS/PS/ES/EdDSA via PEM, JWK, JWKS	Often decode plus limited verify
Live expiry countdown	Yes - ticking badge	Rarely
Diff and copy-as-code	Yes - token diff plus curl/fetch/Python	Rarely
Price	Free	Freemium/paywall

JWKS-URL fetching is CORS-limited in any browser-only tool; paste the JWK or JWKS JSON for reliable verification.