JWT Debugger

Debugging JWT Authentication Problems

JWT authentication fails for many reasons: expired tokens, wrong issuer, mismatched audience, clock skew, or missing claims. Our JWT debugger lets you see inside the token to identify the exact problem, instead of guessing from cryptic auth errors.

Paste the full token from your Authorization: Bearer header, cookie, or auth library output. The debugger shows all standard claims (iss, sub, aud, exp, iat, nbf) plus any custom claims your auth server adds. Timestamps are converted to readable dates.

The header section shows which algorithm was used for signing (HS256, RS256, ES256, etc.) and the key ID (kid) if present. This is important when debugging key rotation issues or JWKS (JSON Web Key Set) configuration problems.

Tips

• If exp is in the past, the token is expired. Check your token refresh logic.
• If aud doesn't match your application's client ID, the token wasn't issued for your app.
• Clock skew between servers can cause tokens to appear expired. Most auth libraries allow a small leeway (30-60 seconds).
• The kid (Key ID) in the header tells you which key to use for verification — critical for JWKS rotation.