JWT Toolkit
Everything for working with JSON Web Tokens, in one place — decode, understand, verify, build, and secure them. All eight tools run entirely in your browser; nothing you paste is ever sent anywhere.
How these fit together
Start with JWT Decoder to see what's actually inside a token, then JWT Claims Viewer to get every field in the payload explained in plain English, standard claims and custom ones alike. To confirm a token is genuinely valid — not just well-formed — JWT Signature Verifier checks it against an HMAC, RSA, or ECDSA key, and JWT Inspector layers in common security red flags on top of that. JWT Expiration Checker is usually the first thing worth checking when an otherwise-valid token starts failing auth for no obvious reason, and JWT Audience Validator does the same for the aud claim specifically — checking it against the audience your service actually expects, string or array form either way. And when you need a token to test against instead of one from a real system, JWT Generator builds and signs one from scratch. Before signing anything for real, though, JWT Secret Strength Checker is worth a look — it checks whether an HMAC secret is actually long enough per spec and isn't one of the common default values real cracking tools try first.
JWT Decoder
Decode JSON Web Tokens and inspect header, payload and signature.
JWT Claims Viewer
See every JWT claim explained in plain English, standard vs. custom.
JWT Inspector
Decode a JWT, verify its HMAC signature, and surface common security issues.
JWT Signature Verifier
Verify a JWT signature with HMAC, RSA (RS256) or ECDSA (ES256) keys.
JWT Expiration Checker
Check if a JWT is expired with a live countdown to (or since) its exp claim.
JWT Audience Validator
Check a JWT's aud claim against the audience your service expects.
JWT Generator
Build and sign a JSON Web Token from a custom header, payload and secret.
JWT Secret Strength Checker
Check whether an HMAC secret is strong enough to sign JWTs safely.