Analyze and debug JSON Web Tokens (JWT) in real-time. Decode header parameters, payload claims, expiration timestamps, and cryptographic algorithms instantly. Calculated 100% locally in your browser for absolute credential security.
JSON Web Token (JWT) is an open, industry-standard RFC 7519 method for representing claims securely between two parties. JWTs are commonly used for stateless authorization and information exchange, allowing clients and servers to trust assertions (such as a logged-in user's identity) without querying a database on every request.
Yes, absolutely. Unlike many third-party debuggers that process strings on their servers, Checkistan runs all base64url decoding, JSON parsing, and timestamp translations fully client-side using native JavaScript within your local browser sandbox. Your tokens never leave your device.
HS256 (HMAC with SHA-256) is a symmetric algorithm, meaning a single shared secret key is used both to sign and verify the token. RS256 (RSA Signature with SHA-256) is an asymmetric algorithm, utilizing a private key to sign the token and a public key for verification. RS256 is generally preferred in distributed, multi-service environments because services can verify tokens without knowing the private key.
You can modify the decoded text of the header or payload and re-encode it, but doing so invalidates the signature. Because the signature is calculated over the encoded header, payload, and a secret key, any change in the payload will cause signature validation to fail on the receiving server, unless you possess the exact private signing key.
These are registered claim keys defined in RFC 7519: 'sub' (Subject) represents the unique identifier of the user or entity, 'iat' (Issued At) is the Unix epoch timestamp indicating when the token was created, and 'exp' (Expiration Time) is the Unix timestamp after which the token must be rejected as invalid.