Developer Tools
JWT Debugger & Token Inspector
100% Client-Side. Tokens and secret keys are never transmitted to any server.{
"alg": "HS256",
"typ": "JWT",
"kid": "auth0-key-1"
}{
"iss": "https://auth.devsload.com/",
"sub": "usr_89f0a21d",
"aud": [
"https://api.devsload.com/v1",
"https://devsload.com"
],
"iat": 1792761383,
"exp": 1792768883,
"nbf": 1792761383,
"name": "Alex Mercer",
"email": "alex.mercer@example.com",
"roles": [
"developer",
"admin"
],
"scope": "read:profile write:projects delete:cache"
}Standard Claims Breakdown
RFC 7519 registered claims detected in payload
| Claim | Definition | Value & Interpretation |
|---|---|---|
| expExpiration Time | Timestamp on or after which the token MUST NOT be accepted. | 1792768883 📅 Fri, 23 Oct 2026 15:21:23 GMT (2d ago) |
| iatIssued At | Timestamp at which the JWT was issued. | 1792761383 📅 Fri, 23 Oct 2026 13:16:23 GMT (3d ago) |
| nbfNot Before | Timestamp before which the token MUST NOT be accepted. | 1792761383 📅 Fri, 23 Oct 2026 13:16:23 GMT (3d ago) |
| issIssuer | Principal that issued the JWT (e.g. auth service URL). | https://auth.devsload.com/ |
| subSubject | Principal that is the subject of the JWT (e.g. user ID). | usr_89f0a21d |
| audAudience | Recipients that the JWT is intended for (e.g. client ID or API audience). | ["https://api.devsload.com/v1","https://devsload.com"] |
| namename | Custom claim payload property. | Alex Mercer |
| emailemail | Custom claim payload property. | alex.mercer@example.com |
| rolesroles | Custom claim payload property. | ["developer","admin"] |
| scopescope | Custom claim payload property. | read:profile write:projects delete:cache |
How to Debug and Verify JSON Web Tokens
Understanding the structure and security of RFC 7519 JSON Web Tokens.
1. Paste or Generate Your Token
Paste any bearer JWT into the input field. DevsLoad instantly splits the three dot-separated segments (Header, Payload, and Signature) and decodes the Base64URL encoding into readable JSON.
2. Inspect Standard and Custom Claims
Examine standard RFC 7519 claims such as exp (expiration), iat (issued at), iss (issuer), sub (subject), and aud (audience). Our inspector highlights time-based claims and shows human-readable countdowns.
3. Verify Cryptographic Signatures Safely
Enter your shared HMAC secret (for HS256/384/512) or public PEM certificate (for RS256/ES256). The verification executes entirely within your browser using the native Web Crypto API without sending keys across the internet.
4. Export or Test in API Clients
Use the quick-copy buttons to copy the decoded JSON payload, full token string, Authorization Bearer header, or cURL request flags for immediate integration testing.
Frequently Asked Questions about JWTs
What is a JSON Web Token (JWT)?
A JSON Web Token (RFC 7519) is a compact, URL-safe means of representing claims to be transferred between two parties. It is digitally signed using a cryptographic secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
Is it safe to paste private or sensitive JWTs into DevsLoad?
Yes, 100%. DevsLoad processes and verifies JWTs entirely on the client side using your web browser’s native Web Crypto API and TextDecoder. Tokens, payload claims, and secret keys are never transmitted to our servers or stored in any database.
What are the three parts of a JWT?
A standard JWT consists of three parts separated by dots (xxxxx.yyyyy.zzzzz): 1) Header: specifies the token type (JWT) and signing algorithm (e.g. HS256 or RS256); 2) Payload: contains the claims and identity statements; 3) Signature: cryptographic hash ensuring that the message was not altered in transit.
What is the difference between HS256 and RS256?
HS256 (HMAC with SHA-256) is a symmetric algorithm where both the issuer and the verifier share the same secret key. RS256 (RSA Signature with SHA-256) is an asymmetric algorithm where the token is signed with a private key and verified by clients using the corresponding public key.
What happens when a token is expired (exp claim)?
The exp (expiration time) claim identifies the Unix epoch timestamp on or after which the JWT MUST NOT be accepted for processing by APIs. DevsLoad compares this timestamp against your system clock and alerts you if the token has expired.