Is it safe to paste sensitive production JWTs into this tool?

Yes, 100%. This tool operates completely in your browser memory via native JavaScript. Zero tokens, claims, or secrets are ever transmitted to any server or logged in any database.

What is the difference between HS256 and RS256?

HS256 is a symmetric algorithm using a single shared secret key for both signing and verifying. RS256 is an asymmetric algorithm using a private key to create the signature and a public key to verify it.

100% Client-Side Privacy

JWT Debugger & Token Inspector

Inspect JSON Web Token headers, payloads, and claims instantly. Tokens never leave your browser, ensuring zero risk of credential leakage.

Zero Server Transmission Live Expiration Timer HMAC-SHA256 Verification Human Claim Timestamps

Encoded Token

Paste your Base64URL-encoded JWT token here:

● Header ● Payload ● Signature

HEADER: Algorithm & Token Type

PAYLOAD: Data Claims

VERIFY SIGNATURE Awaiting Secret

Understanding JSON Web Tokens (JWT) Architecture

A JSON Web Token (RFC 7519) is a compact, URL-safe means of transferring security assertions between two parties. JWTs are commonly used for stateless authorization headers in Single Page Applications (SPAs) and REST microservices.

Core Structure of a JWT

Header: Typically consists of two parts: the signing algorithm being used (such as HS256 or RS256) and the token type (JWT).
Payload: Contains the claims — key-value statements about the authenticated user and contextual metadata (like sub, iss, iat, and exp).
Signature: Created by encoding the header and payload using Base64URL, then hashing them with a secret key to ensure the contents have not been tampered with in transit.