JWT Debugger & Local Signature Verifier
Every cloud-based JWT debugger requires you to paste sensitive tokens into a third-party website — a critical security violation. This tool decodes, validates claims, detects PII, and cryptographically verifies signatures using the Web Crypto API, entirely in your browser. Your tokens never leave this page.
Tool interface
Decoded Token
Temporal Claims
🔐 Signature Verification
Paste the public key (JWK JSON or PEM format) to verify the signature locally using the Web Crypto API.
Introduction
JSON Web Tokens are the backbone of modern authentication, but debugging them safely has always required a trade-off: paste your token into a convenient cloud tool and risk leaking sensitive data, or write custom decoding scripts. This tool eliminates that trade-off by bringing full JWT inspection — including cryptographic signature verification — into your browser with zero network dependency.
How It Works
- The JWT is split into its three Base64URL-encoded segments (header, payload, signature).
- Header and payload are decoded and pretty-printed as JSON.
- Temporal claims (
exp,nbf,iat) are validated against your local system clock. - The payload is scanned for common PII patterns (emails, phone numbers, SSNs).
- For signature verification, the public key is imported via
crypto.subtle.importKey()and the signature is verified withcrypto.subtle.verify(). - ECDSA signatures are converted from DER encoding to the raw (r‖s) format required by Web Crypto.
Privacy
This tool makes zero network requests. Your JWT, public key, and all decoded data exist only in your browser's JavaScript heap. Nothing is transmitted, logged, or stored. You can verify this by opening DevTools → Network and observing that no requests fire while using the tool.
Limitations
- Only asymmetric algorithms (RS*, PS*, ES*) are supported for verification. Symmetric algorithms (HS256) require the shared secret, which is unsafe to handle in a browser.
- Signature verification requires the correct public key. Without it, only decoding and claim validation are available.
- The tool does not validate the token's
aud,iss, or custom claims against an external authority — that requires your application's business logic.
FAQ
Is it safe to paste a production JWT here?
Yes. This tool runs entirely in your browser with zero network calls. Unlike cloud-based JWT debuggers, your token is never transmitted to a server. You can verify this in DevTools → Network.
Why can't I verify HS256 tokens?
HS256 uses a shared secret key. Entering a shared secret into any client-side tool defeats its purpose, since anyone with the secret can forge tokens. Use asymmetric algorithms (RS256, ES256) for secure verification.
What format should the public key be in?
Either JWK (JSON Web Key) format or PEM-encoded SPKI (SubjectPublicKeyInfo). Both are supported. For RSA keys, the JWK needs kty, n, and e fields. For EC keys, it needs kty, crv, x, and y.