Debug JWTs in your browser with the WorkOS JWT Debugger
Decode, verify, and inspect JWTs; built by the team that does auth for a living.
If you've ever worked with JWTs, you've probably done the same thing every developer does: copied a token, opened a new tab, pasted it into a debugger, and squinted at the decoded payload trying to figure out why your auth flow is broken.
We just shipped a tool to make that a little easier: the WorkOS JWT Debugger.
What it does
It's a free, browser-based JWT debugger. Paste in a token, instantly see the decoded header, payload, and signature. No signup required, no data sent to a server, everything runs locally in your browser.
You can use it to:
- Decode any JWT and inspect its header and payload claims.
- Verify signatures to confirm a token hasn't been tampered with.
- Check expiration and other time-based claims at a glance.
- Generate JWTs by providing header, payload, and signature details.
Why we built it
JWT debuggers aren't new. But the tools developers actually rely on day-to-day tend to live on third-party sites that aren't always maintained by the companies building the auth infrastructure you're using.
We build authentication and identity tools for a living. JWTs are core to how WorkOS sessions, access tokens, and AuthKit work. It made sense for us to offer a debugger that lives alongside the rest of our developer docs and tooling; something we'll keep maintained and up to date as the ecosystem evolves.
If you're already using WorkOS for SSO, directory sync, or user management, having a JWT debugger a click away from your dashboard and docs is a small convenience that adds up.
A quick refresher on JWTs
A JWT (JSON Web Token) is a compact, URL-safe way to represent claims between two parties. It's the standard mechanism behind most modern auth flows like OAuth 2.0 and OpenID Connect.
Every JWT has three parts, separated by dots:
- The header specifies the token type and signing algorithm (e.g., RS256, HS256).
- The payload carries the claims, things like the user ID (
sub), issuer (iss), expiration (exp), and any custom data your app needs. - The signature ensures the token hasn't been modified in transit.
When something goes wrong in your auth flow (a 401 you can't explain, a permission check that's failing, a token that seems like it should be valid) the first thing you do is decode the JWT.
Is exp in the past? Is aud set to the wrong value? Is sub what you expected?
That's exactly what this tool is for.
Security first
The WorkOS JWT Debugger processes everything client-side. Your tokens never leave your browser. We built it this way because JWTs are credentials; you shouldn't have to trust a third party with your access tokens just to debug them.
Try it out
Head over to the JWT Debugger and paste in a token. It's free, it's fast, and it's one less tab you need to keep open.
And if you're building an app that issues or validates JWTs, take a look at the rest of what WorkOS offers, from AuthKit for drop-in authentication to JWT Templates for customizing your access token claims.
We're building the auth infrastructure so you don't have to.