JWT Debugger & Inspector (Privacy-First)
Decode, inspect claims, and verify cryptographic signatures of JWT tokens in real time with the browser Web Crypto API. Zero server transmissions.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe"
}Suporte nativo a segredos HMAC (HS256/384/512 em UTF-8 ou Base64) e Chaves Públicas RSA (RS256 em PEM).
What is a JSON Web Token (JWT) and How Does It Work?
A JSON Web Token (RFC 7519) is a compact, URL-safe means of representing claims to be transferred between two parties. It is composed of three Base64URL-encoded segments separated by dots: Header, Payload, and Signature.
Unlike online token decoders, this inspector runs strictly inside your local browser memory using the W3C Web Cryptography API. No tokens, personal identity claims, or private secrets leave your machine.
Anatomy and Structure of JWT Claims (RFC 7519)
A JWT organizes information into standardized claims across three distinct parts:
| Segment | Field / Claim | Format | Technical Purpose | Canonical Example |
|---|---|---|---|---|
| 1 | alg | Header | Cryptographic algorithm used to sign the token (e.g. HS256, RS256). | HS256 |
| 1 | typ | Header | Media type declaration of the token (typically 'JWT'). | JWT |
| 2 | sub | Payload | Subject: Unique identifier of user or principal entity. | usr_9981a7b4c |
| 2 | iss | Payload | Issuer: Identifies the identity provider or authority issuing the token. | https://accounts.google.com |
| 2 | exp | Payload | Expiration Time: Unix timestamp (in seconds) marking expiration. | 1741387200 |
| 3 | Signature | JWS | Cryptographic signature computed over header and payload hashes. | HMACSHA256(b64(Header) + '.' + b64(Payload), secret) |
Signature Verification & Security Best Practices
Token integrity is evaluated in line with RFC 8725 recommendations:
- 1. Cryptographic Signature Verification (JWS): The engine recomputes the digital signature over 'Header.Payload' using the supplied secret via Web Crypto API (crypto.subtle.verify), proving content authenticity.
- 2. Algorithm Confusion & Substitution Prevention: The debugger highlights and rejects insecure tokens specifying 'alg: none' or weak keys, preventing signature bypass attacks.