Is my secret exposed?

No. Secrets and keys stay in memory in your browser tab and are never persisted or sent anywhere. Only a JWKS URL fetch uses the FizzKit relay, and the token itself is not part of that request.

Can I edit claims and re-sign?

Yes. Modify the header or payload JSON in Edit & sign, keep or change the algorithm, supply the secret or private key (PKCS#8, PKCS#1 or SEC1 PEM, or a private JWK) and click Sign. Use "Use as input" to verify the new token immediately.

What is the difference from the JWT Decoder?

It is the same tool. This page opens on the Verify tab for people who arrive with a signature to check; the JWT Decoder page opens on the Decoded tab.

JWT Debugger

Debug JSON Web Tokens end to end: verify HS256/384/512 signatures with a shared secret and RS/PS/ES signatures with a PEM public key, JWK or a JWKS fetched from the issuer, see exactly why a signature fails, edit claims and re-sign with the same key, and catch alg:none, algorithm-confusion and expiry problems before they reach production. Opens straight on the Verify tab of the JWT Decoder.

Fetches URLs via the FizzKit relay — nothing is stored

Open fullscreen for long tokens and side-by-side claim tables

JWT

0 chars · 1 line

Samples:⌘↵ verifies (or signs in Edit / Builder)

Paste a JWT to decode it

Header and payload are decoded instantly with claim descriptions and expiry status. Verify HS / RS / PS / ES signatures with a secret, PEM, JWK or a JWKS URL, then edit and re-sign.

JWT Decoder

Decode, verify (HS/RS/ES/PS, JWKS) and sign JWTs

HMAC Generator & Verifier

Sign and verify HMAC-SHA256/SHA1/SHA512/MD5/SHA-3 signatures with Stripe, GitHub, Shopify, Slack and Twilio presets.

Hash Generator

MD5, SHA-1, SHA-256/384/512, SHA-3, CRC32 and xxHash32 for text, lines and files — with verify and checksum export.

Bcrypt Generator / Checker

Hash passwords with bcrypt, verify hashes, generate salts and benchmark cost factors on your device.

How to use JWT Debugger

1Paste the token you want to check — the Verify tab opens with the algorithm read from the header.
2Provide the key: a shared secret for HS*, a PEM public key or certificate for RS/PS/ES, a JWK, or a JWKS URL (click "From iss" to discover it).
3Read the result banner — valid, or the exact reason it failed (wrong key, wrong encoding, rotated kid, tampered payload).
4Fix claims in Edit & sign, or build a new token in Builder, then Sign with the same key and copy the result.

About JWT Debugger

JWT Debugger is part of FizzKit — a collection of focused developer and ad-tech tools. This tool uses the FizzKit relay to fetch public URLs on your behalf (so browser CORS rules do not get in the way); fetched content is returned to your browser and not stored.

Frequently asked questions

HS256, HS384 and HS512 with a shared secret; RS256/384/512 and PS256/384/512 with an RSA public key; ES256/384/512 with an EC public key on P-256, P-384 or P-521. EdDSA is decoded but not verified.

Related tools