JWT Builder & Inspector
Build unsigned JWTs and inspect header and expiry claims.
Sensitive data: Anything you enter is processed in your browser only. It is never uploaded or logged on a server.
Working with JWT encode, decode, and verify flows
JSON Web Tokens carry claims between an issuer and a relying party. Besides the standalone JWT debugger, this hub groups related operations for inspecting, building, and validating tokens during auth integration work. Each mode targets a step in the same overall workflow.
Decoding reveals header and payload claims without proving integrity. Verification requires the correct secret or public key and algorithm policy. Mixing those steps causes teams to trust readable payloads that an attacker could forge.
Standard claims like exp, nbf, aud, and iss deserve first attention when debugging 401 responses. Custom claims map to roles, tenants, or feature flags in your application. Document expected claim shapes beside your middleware so reviewers know what valid looks like.
Use JWT tools on staging tokens with synthetic users when possible. Rotate compromised secrets after debugging sessions and never store production bearer tokens in ticket systems or screen recordings.
Reference Guide
JWT utilities cover decode, verify, and build flows. Decoding alone does not prove a token is trustworthy.
| Claim | Check during 401 debugging |
|---|---|
exp | Expired tokens fail even if payload looks valid |
aud / iss | Must match API configuration exactly |
alg | Verifier must allow only expected algorithms |
Never commit production bearer tokens to repositories or screenshots.
Current mode
Operation: jwt-build
All processing runs locally in your browser. Paste input, click Run, and copy the result.
Example Input
{"alg":"HS256","typ":"JWT"}Example Secondary Input
{"sub":"demo","name":"DevPipe"}A sample loads automatically when you open this tool. Use Load Sample to reset it.