b2KIT

JWT Debugger

Debug JSON Web Tokens with live editing of header and payload, automatic re-encoding, and signature verification.

Tested tool guide Tested browser tools Checked August 16, 2026

What JWT Debugger does, with a checked example

A compact JWT becomes inspectable as its JOSE header, claims payload, and signature status. The debugger accepts the serialized token, decodes the first two base64url segments into editable JSON, and re-encodes them as the text changes. With the appropriate secret or verification key, it can check whether the third segment matches the signing input. The important surprise is that decoding is not verification: anyone holding a normal signed JWT can read its header and payload, even without the key.

Worked example

A concrete input and expected output from the current implementation.

Input

JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
HMAC secret: your-256-bit-secret

Expected output

Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
Signature: valid

The first two segments are the base64url encodings of the displayed JSON objects. Using the literal UTF-8 bytes of "your-256-bit-secret", HS256 produces the signature represented by the third segment, so verification succeeds.

How the result is produced

1

Segment decoding and editing

A three-segment compact token is split at its two periods. The first and second segments are base64url-decoded and parsed as the JOSE header and claims object. When either JSON value is edited, the debugger base64url-encodes the new UTF-8 JSON and updates those segments, without treating the readable payload as proof of authenticity.

2

Signature verification

For a signed JWT, verification covers the encoded header, a period, and the encoded payload exactly as serialized. The header's alg value identifies the signature method, while verification still requires compatible key material. HS256 uses the exact bytes of a shared secret; asymmetric signature methods require the corresponding verification key. A mismatch produces an invalid result.

Good uses

  • Decode a bearer token from a failing request and inspect claims such as iss, aud, sub, scope, or exp without manually processing base64url text.
  • Edit a header or payload during local development and observe the resulting compact-token segments before testing how an application handles the changed claims.
  • Check whether a captured signed JWT matches a known HMAC secret or verification key before investigating authorization logic elsewhere.

Limits and checks

  • Readable claims are not authenticated claims until signature verification succeeds. An attacker can construct arbitrary header and payload segments that decode normally.
  • A valid signature does not prove that the issuer is trusted, the audience is correct, the token is unexpired, or the application should authorize the requested action.
  • Shared-secret verification is byte-sensitive. Plain text, base64-encoded key text, decoded key bytes, trailing newlines, and visually similar characters can produce different HS256 signatures.

Common questions

Can the debugger tell me whether a JWT is safe to trust?

No. Successful verification only establishes that the signature matches the displayed signing input under the supplied key. Trust also depends on where that key came from and whether the application accepts the issuer, audience, time claims, algorithm, and other required claims. The debugger cannot determine an application's authorization policy from the token alone.

Why does the signature become invalid after I edit the payload?

The encoded payload is part of the exact JWS signing input. Changing even one claim changes that encoded segment, so the original signature no longer corresponds to the token. The edited JWT can verify only if a new signature is produced with appropriate signing material and the algorithm declared by its protected header.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

JSON Formatter & Validator

Format, validate, and beautify JSON with syntax highlighting and error detection.

Base64 Encoder / Decoder

Encode text or files to Base64 and decode Base64 strings back to their original form.

SQL Formatter & Beautifier

Format and indent SQL queries for better readability across all major dialects.

HTML to Markdown Converter

Convert HTML markup into clean Markdown syntax with support for tables and lists.

Markdown to HTML Live Preview

Write Markdown and see the rendered HTML output in real time with live preview.

Diff / Patch Viewer

Visualize unified diffs and patch files with color-coded additions and deletions.