# JWT & JWE Debugger

Decode, verify, sign, encrypt, and decrypt JSON Web Tokens. Our JWT debugger helps you inspect JWT headers and claims, verify signatures, and convert tokens to/from encrypted JWE form.

## JWT Example:

### Generate JWT Token

✓ Valid JWT  
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1aWRfMTIzNDUiLCJuYW1lIjoiSm9obiBEb2UiLCJpYXQiOjE3OTMwODY1NzIsImV4cCI6MTc5MzA5MDE3Mn0.iN0NjOWXKC9_C3KvVaENjzq_PCYxT-4_6BVQRV5bMZg

### Decoded Header

```
{
  "alg": "HS256",
  "typ": "JWT"
}
```

### Decoded Payload

```
{
  "sub": "uid_12345",
  "name": "John Doe",
  "iat": 1793086572,
  "exp": 1793090172
}
```

### JWT Signature Verification: Secret

Algorithm: HS256

### Encoding Format

UTF-8  
base64url

## JWE Example:

### Generate JWE Input

#### Encryption Configuration

Algorithm (alg)
- RSA-OAEP
- RSA-OAEP-256
- ECDH-ES
- ECDH-ES+A128KW
- ECDH-ES+A192KW
- ECDH-ES+A256KW
- A128KW
- A256KW

Encryption Method (enc)
- A128GCM
- A256GCM

### JWE Output

Encrypted JWE will appear here.

#### Decoded JWE Header

Decoded JWE header will appear here.

#### Decoded JWT Header

Decoded JWT header will appear here.

### Decoded Payload

Decoded payload will appear here.

### JWT Output

Decrypted JWT will appear here.

## How the JWT & JWE Debugger Works

### Step 1.
Paste or Generate a JWT:
- Input your JWT to see its decoded header and payload instantly.
- The tool can verify the JWT's signature to confirm authenticity and integrity, highlighting whether the token is valid or has been tampered with.

### Step 2.
Verify signature (JWT verification):
- Supply a JWK or JWKS (jwk format / jwks.json) or paste a PEM public key to verify a token's signature and confirm integrity. The debugger shows kid, alg, and verification status.

### Step 3.
Sign / Create a JWT:
- Build a signed JWT by choosing algorithm (RS256, ES256, HS256, etc.) and a signing key. This is useful for testing JWT authentication flows and experimenting with JWT best practices.

### Step 4.
Encrypt JWT to JWE:
- Encrypt a signed JWT into a JWE (JSON Web Encryption) using a public key to produce confidential tokens. Use JWE when you need payload confidentiality in addition to signature integrity.

### Step 5.
Decrypt JWE:
- Paste a JWE and provide the private key to decrypt and retrieve the original JWT. The tool supports common JWE algorithms and shows header fields and enc parameters.

### Step 6.
Inspect claims & debug:
- View claims, check exp/iat/nbf logic, and see human-friendly warnings (expired, not yet valid). Use copy buttons to export tokens or keys for local testing.

## What is a JWT (JSON Web Token)?

A JWT (JSON Web Token) is an open standard (RFC 7519) for transmitting information securely between parties as a compact, URL-safe JSON object.  JWTs are widely used in authentication systems, enabling stateless session management and API security. A standard JWT has three parts:

- **Header**: Specifies the token type and hashing algorithm.
- **Payload**: Contains claims—statements about the user and additional metadata.
- **Signature**: Verifies that the sender of the JWT is who it says it is and ensures the message wasn't changed along the way.

Common Use Cases:
- User authentication and single sign-on (SSO)
- Secure API authentication and authorization
- Information exchange between applications

## What is a JWE (JSON Web Encryption)?

A JWE (JSON Web Encryption) is another open standard (RFC 7516) for encrypting content, providing confidentiality for transmitted information. JWE wraps content—such as a signed JWT—in an encrypted format that only intended parties can decrypt and read.

### JWE Structure:
- **Protected Header**
- **Encrypted Key**
- **Initialization Vector**
- **Ciphertext (the actual encrypted content)**
- **Authentication Tag**

Common Use Cases:
- Protect sensitive JWT payloads in transit
- Secure confidential data exchange between services
- Layer additional security on top of standard JWTs

## JWT & JWE Debugger Best Practices

- **Signature**: Verifies that the sender of the JWT is who it says it is and ensures the message wasn't changed along the way.
- **Payload**: Contains claims—statements about the user and additional metadata.
- **Header**: Specifies the token type and hashing algorithm.