JWT Debugger
Decode, edit, re-sign, and verify JSON Web Tokens. Edit the header or payload, provide an HMAC secret, and re-sign the token — all in your browser using the Web Crypto API.
How JWT Signature Verification Works
A JWT has three Base64url-encoded parts: header, payload, and signature. For HMAC algorithms (HS256/HS384/HS512), the signature is computed as HMAC(header.payload, secret). Verification re-computes the HMAC with the same secret and compares it to the token's signature. If they match, the token has not been tampered with. Editing the header or payload invalidates the original signature — you must re-sign with a valid secret to produce a new valid token.
JWT split at dots — header and payload Base64url-decoded to reveal JSON, signature kept as raw bytes
Header and payload JSON editable in real-time — changes reflected immediately in the re-encoded JWT
Modified header.payload signed with HMAC-SHA256/384/512 using the provided secret via Web Crypto API
Signature verified by re-computing HMAC with the same secret and comparing — timing-safe comparison in Web Crypto
Original and modified JWTs shown side by side — differences in claims, timestamps, and signatures highlighted
Spec: RFC 7519 (JWT), RFC 7515 (JWS), RFC 2104 (HMAC), Web Crypto API