Question 1

Is it safe to paste my production JWT token into this debugger?

Accepted Answer

Yes, because DevTools Lab decodes tokens entirely in your browser using client-side JavaScript. Unlike conventional online debuggers, your token is never transmitted over the network or saved in server logs.

Question 2

Can this tool verify the cryptographic signature?

Accepted Answer

This tool inspects the token structure, header algorithm, expiration timestamps, and payload claims. Cryptographic verification requires your private key or HMAC secret, which should always be kept secure in your private backend.

Question 3

What are the common JWT claims like sub, exp, and iat?

Accepted Answer

`sub` stands for Subject (e.g. User ID), `exp` is the Expiration timestamp in seconds since Unix epoch, and `iat` is the Issued At timestamp.

JSON Web Token (JWT) Inspector & Debugger

Frequently Asked Questions