JWT Debugger, Signer & Token Inspector
Decode JSON Web Tokens (JWT) in real time. Inspect header algorithms, payload user claims (`sub`, `iat`, `exp`), calculate expiration countdown timers, and verify HMAC SHA-256 cryptographic signatures locally using the Web Cryptography API.
// Decoded header JSON will appear here...// Decoded payload JSON will appear here...Understanding JSON Web Tokens (JWT) Architecture, Security Claims, & Signature Verification
**JSON Web Token (JWT)**, standardized under **RFC 7519**, is an open, compact, URL-safe means of representing claims to be transferred between two parties. In modern web architectures — including single-page applications (React, Next.js, Vue), mobile apps (iOS, Android, Flutter), and microservice API gateways — JWTs are the dominant standard for stateless user authentication and authorization.
Unlike traditional server-side session cookies that require database lookups (`session_id`), a JWT contains all user claims (such as user ID, role, permissions, and email) directly inside the token payload itself. The receiving server simply verifies the cryptographic signature without querying a session database.
The HiFi Toolkit JWT Debugger & Token Inspector brings professional security auditing directly to your browser. Powered by native Web Cryptography API (`crypto.subtle`), our tool decodes Base64URL claims, verifies HMAC SHA-256 signatures, and calculates token expiration countdowns — **100% locally with zero server uploads**.
The 3 Parts of a JWT Token
A encoded JWT string consists of three distinct parts separated by dots (.):
1. Header
Specifies token type (`"typ": "JWT"`) and signing algorithm used (`"alg": "HS256"` or `"RS256"`).
2. Payload
Contains standardized claims (`sub`, `iss`, `aud`, `iat`, `exp`) and custom user claims (`role`, `email`).
3. Signature
Cryptographic hash created by signing `Base64URL(header) + "." + Base64URL(payload)` with a secret key.
Standard Registered Claims Explained
| Claim Name | Full Name | Description |
|---|---|---|
iss | Issuer | Identifies the principal that issued the JWT (e.g. https://auth.company.com) |
sub | Subject | Identifies the subject of the JWT (e.g. Unique User ID) |
exp | Expiration Time | Unix timestamp (in seconds) after which the JWT must be rejected. |
iat | Issued At | Unix timestamp (in seconds) indicating when the token was created. |
How to Debug & Verify JWT Tokens
- Paste Encoded JWT: Paste any encoded JWT token string into the left input box.
- Inspect Claims: View decoded Header JSON and Payload JSON object structures on the right.
- Verify Signature: Enter your secret key into the **Verify Signature Secret Key** box. The badge will indicate Verified Signature or alert an invalid signature.
