JWT Debugger & Token Decoder
Inspect, decode, and verify JSON Web Tokens (JWT) in real-time. Verify expiration status and audit claims with 100% in-browser confidentiality.
Expired on Thu, 01 Jan 2026 06:13:20 GMT (approx. 7423.1 hours ago)
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "usr_91827450",
"name": "Alexander Mercer",
"email": "[email protected]",
"role": "admin",
"aud": "https://api.genstack.tools",
"iss": "genstack-auth",
"iat": 1735689600,
"exp": 1767248000
}JWT Architecture, JWS Compact Serialization & Security Pitfalls
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties. Defined in RFC 7519 and implemented via JSON Web Signature (JWS, RFC 7515), JWTs power modern OAuth 2.0, OpenID Connect (OIDC), and stateless RESTful session authentication.
JWS Compact Serialization
A JWT consists of three Base64URL-encoded JSON structures concatenated with periods: BASE64URL(Header) . BASE64URL(Payload) . BASE64URL(Signature). The signature is computed over the first two parts using the algorithm specified in the header.
Algorithm Confusion Attack
A catastrophic vulnerability occurs when server verification logic naively trusts the token's alg header. Attackers can switch asymmetric algorithms (RS256) to symmetric HMAC (HS256) and sign fraudulent tokens using the public key.
Claims Are NOT Encrypted
Standard JWTs are signed, not encrypted (unless using JWE RFC 7516). Anyone holding the token can decode and inspect all claims in plaintext. Never store passwords, API secret keys, or sensitive PII inside JWT payloads.