Skip to main content

Authorized use only. Use this tool solely on systems, tokens, and assets you own or are explicitly permitted to test — credential extraction, signature forging, and unauthorized access are prohibited by our Acceptable Use Policy.

Toolkit

JWT & Auth Toolkit

Everything you need to debug authentication flows — decode and verify JWTs, inspect SAML messages, build OIDC URLs, and generate secure tokens. All tools are free, private, and run entirely in your browser.

JWT Debugger

Core

Decode header, payload, and claims. Verify HS256/HS384/HS512 with a secret or RS256/ES256 with a public key. See expiry status at a glance.

SAML Decoder

Protocol

Decode SAML AuthnRequest and Response messages (Redirect and POST bindings) with pretty-printed XML. For Okta, Entra ID, Shibboleth debugging.

OIDC URL Builder + PKCE

Protocol

Build OAuth 2.0 / OpenID Connect authorize URLs with scopes, state, nonce, and S256 PKCE code challenges. Works with Okta, Auth0, Entra ID, Keycloak.

Base64 Encoder/Decoder

Utility

JWT headers and payloads are Base64URL-encoded. Encode or decode instantly to inspect the raw segments.

Token Generator

Utility

Generate cryptographically secure random tokens and API secrets (hex, base64, custom alphabet) for testing auth flows.

Basic Auth Generator

Utility

Build HTTP Basic Authentication headers for testing API endpoints that require username/password auth.

TOTP Generator

2FA

Generate time-based OTP codes from a secret — useful for testing 2FA/MFA flows in your auth pipeline.

Hash Generator

Crypto

Generate SHA-256, SHA-512, HMAC, Argon2id, bcrypt, and PBKDF2 hashes — the same algorithms used in password storage and token signing.

Password Strength Analyzer

Security

Check password entropy and get improvement suggestions before using it as a signing secret.

Common JWT debugging tasks

Why is my token expired? Paste it in the JWT Debugger and check the expiry banner — it shows exactly when the token expires and how long ago it expired. The exp claim is a Unix timestamp; the Claims Breakdown translates it to your local time.

How do I verify a token's signature? For HS256 tokens, paste the shared secret in the verification section. For RS256/ES256, paste the PEM public key. Verification uses the browser's native Web Crypto API — your secret never leaves your machine.

What claims should I check? The registered claims (iss, sub, aud, exp, iat, nbf) each have a standard meaning. The Claims Breakdown labels each one and explains what it controls.

Need this on-premise or behind your firewall?

We ship a self-hosted enterprise edition of our identity tools (SAML, OIDC, JWT) — air-gapped, auditable, no data leaves your network. Contact us for details.

Get the on-prem version

About the JWT Suite

Authentication debugging requires more than one tool: you decode the JWT, check its claims, verify the signature, maybe inspect the SAML response that generated it, and generate a secure token for testing. This toolkit groups all of those in one place.

Each tool is linked below with a short description. All are free, private, and run entirely in your browser — no tokens, secrets, or keys are ever transmitted to a server.

How to use

  1. Start with the JWT Debugger to decode and verify your token.
  2. Use the OIDC URL Builder to construct or debug authorization URLs.
  3. Decode SAML messages with the SAML Decoder.
  4. Generate secure test tokens and secrets with the Token Generator.

Frequently Asked Questions

What is the JWT & Auth Toolkit? ▾

A curated collection of authentication debugging tools: JWT decoder and verifier, OIDC URL builder with PKCE, SAML decoder, token generator, TOTP generator, and hash tools. All free and client-side.

Can I use these tools for production debugging? ▾

Yes. All processing happens in your browser — tokens, secrets, and keys are never uploaded. This is safer than server-side JWT tools where your credentials transit a third-party server.

How is the JWT Toolkit different from the JWT debugger? ▾

The toolkit adds verification with your own keys (HS256 secret or RS256 public key), claim-by-claim inspection, and side-by-side algorithm comparison — built for debugging auth flows, not just reading payloads.

Does the toolkit ever send my secrets or tokens anywhere? ▾

No. Signature verification uses Web Crypto locally in your browser. Secrets pasted here never traverse a network.

Why does RS256 verification need only a public key? ▾

RS256 is asymmetric: the issuer signs with a private key, anyone verifies with the public one. That lets you validate tokens without ever holding the signing secret — the safer pattern for multi-service setups.