Skip to main content

Toolkit

JWT & Auth Toolkit

Everything you need to debug authentication flows — decode and verify JWTs, inspect SAML messages, build OIDC URLs, and generate secure tokens. All tools are free, private, and run entirely in your browser.

JWT Debugger

Core

Decode header, payload, and claims. Verify HS256/HS384/HS512 with a secret or RS256/ES256 with a public key. See expiry status at a glance.

SAML Decoder

Protocol

Decode SAML AuthnRequest and Response messages (Redirect and POST bindings) with pretty-printed XML. For Okta, Entra ID, Shibboleth debugging.

OIDC URL Builder + PKCE

Protocol

Build OAuth 2.0 / OpenID Connect authorize URLs with scopes, state, nonce, and S256 PKCE code challenges. Works with Okta, Auth0, Entra ID, Keycloak.

Base64 Encoder/Decoder

Utility

JWT headers and payloads are Base64URL-encoded. Encode or decode instantly to inspect the raw segments.

Token Generator

Utility

Generate cryptographically secure random tokens and API secrets (hex, base64, custom alphabet) for testing auth flows.

Basic Auth Generator

Utility

Build HTTP Basic Authentication headers for testing API endpoints that require username/password auth.

TOTP Generator

2FA

Generate time-based OTP codes from a secret — useful for testing 2FA/MFA flows in your auth pipeline.

Hash Generator

Crypto

Generate SHA-256, SHA-512, HMAC, Argon2id, bcrypt, and PBKDF2 hashes — the same algorithms used in password storage and token signing.

Password Strength Analyzer

Security

Check password entropy and get improvement suggestions before using it as a signing secret.

Common JWT debugging tasks

Why is my token expired? Paste it in the JWT Debugger and check the expiry banner — it shows exactly when the token expires and how long ago it expired. The exp claim is a Unix timestamp; the Claims Breakdown translates it to your local time.

How do I verify a token's signature? For HS256 tokens, paste the shared secret in the verification section. For RS256/ES256, paste the PEM public key. Verification uses the browser's native Web Crypto API — your secret never leaves your machine.

What claims should I check? The registered claims (iss, sub, aud, exp, iat, nbf) each have a standard meaning. The Claims Breakdown labels each one and explains what it controls.

About the Jwt Suite

Authentication debugging requires more than one tool: you decode the JWT, check its claims, verify the signature, maybe inspect the SAML response that generated it, and generate a secure token for testing. This toolkit groups all of those in one place.

Each tool is linked below with a short description. All are free, private, and run entirely in your browser — no tokens, secrets, or keys are ever transmitted to a server.

How to use

  1. Start with the JWT Debugger to decode and verify your token.
  2. Use the OIDC URL Builder to construct or debug authorization URLs.
  3. Decode SAML messages with the SAML Decoder.
  4. Generate secure test tokens and secrets with the Token Generator.

Frequently Asked Questions

What is the JWT & Auth Toolkit? ▾

A curated collection of authentication debugging tools: JWT decoder and verifier, OIDC URL builder with PKCE, SAML decoder, token generator, TOTP generator, and hash tools. All free and client-side.

Can I use these tools for production debugging? ▾

Yes. All processing happens in your browser — tokens, secrets, and keys are never uploaded. This is safer than server-side JWT tools where your credentials transit a third-party server.

Is this tool free to use? ▾

Yes! This tool is 100% free. No signup, no credit card, no limits. It's part of Formatho's privacy-first developer toolkit.

Is my data safe? Does this tool send data to a server? ▾

Absolutely. This tool runs entirely in your browser. Your data never leaves your device. Zero server-side processing, zero tracking.