Devtools.supstudio.in

Tools/JWT

JWT decoder

jwt.io is the reference debugger; this one keeps the same split (header / payload / signature) and adds claim explainers, an expiry timeline, alg none warnings, JWKS paste, and HS256 re-sign — all in the browser. Verification uses Web Crypto. We never see your token.

Encoded JWT

Tokens never leave this tab. Do not paste production secrets into any website you do not control — including this one if you do not trust the machine.

Header

alg HS256

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

3 claims

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Signature

SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

iat / nbf / exp timeline

iat
2018-01-18T01:30:22.000Z
nbf
—
exp
—

Claims

ClaimValueMeaning
sub1234567890Stable identifier for the principal (user, service, device) the token is about.
nameJohn DoeCustom claim. Meaning is defined by the issuer, not RFC 7519.
iat15162390222018-01-18T01:30:22.000Z. Unix seconds when the token was created. Used for age, revocation windows, and debugging.

Verify signature

HMAC: paste the shared secret. RSA/ECDSA: PEM public key or JWK JSON. Browser Web Crypto only — HS256.

Edit payload and re-sign (HS256)

Uses the secret box on the left. Demo secret is your-256-bit-secret.

Verify in code

Decode only. Verification belongs on the server (or Web Crypto with a public key).

const [h, p] = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c".split(".");
const json = (part) => JSON.parse(atob(part.replace(/-/g, "+").replace(/_/g, "/")));
console.log(json(h), json(p));

Algorithms: HS256 · HS384 · HS512 · RS256 · RS384 · RS512 · ES256 · ES384 · ES512 · PS256 · none

Algorithms

Claims

Guides