JWT Debugger

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token defined by RFC 7519. It encodes claims as a JSON object that is digitally signed, making it tamper-evident. JWTs are widely used for authentication and information exchange.

• Header — token type (JWT) and signing algorithm
• Payload — claims (user data, expiry, issuer, etc.)
• Signature — ensures the token hasn't been tampered with

Standard Claims

• iss — Issuer: who created the token
• sub — Subject: who the token is about
• aud — Audience: intended recipients
• exp — Expiration Time: Unix timestamp after which the token is invalid
• nbf — Not Before: Unix timestamp before which the token is not valid
• iat — Issued At: when the token was created
• jti — JWT ID: unique identifier for the token

Signing Algorithms

• HS256 / HS384 / HS512 — HMAC + SHA. Symmetric: same secret signs and verifies. Simple but secret must be shared.
• RS256 / RS384 / RS512 — RSA + SHA. Asymmetric: private key signs, public key verifies.
• ES256 / ES384 / ES512 — ECDSA. Asymmetric with smaller signatures than RSA.
• PS256 / PS384 / PS512 — RSA-PSS. Randomized RSA variant with stronger security properties.