Build your JWT Debugger with AI in under 5 minutes

What is a jwt debugger?

JWT debugger tools are one of the most-searched developer-utility categories on the web — somewhere in the multi-million queries per month for 'jwt decode' / 'jwt debugger' / 'jwt.io' across the English-speaking internet, with a long tail for the specific algorithm queries ('hs256 verify', 'jwt expiration', 'decode bearer token') and the platform-specific ones ('decode cognito token', 'auth0 jwt decode', 'okta jwt'). The category is dominated by a handful of operator-trusted hosted sites (jwt.io owned by Auth0/Okta, jwt.ms owned by Microsoft, jwtcheck, jwt-decoder, jwt-cli) that all run the same base64url + JSON.parse + SubtleCrypto stack under the hood. None of them ship a memorable visual identity beyond the genre's default 'three plain text panels on white'; all of them are THIRD-PARTY SITES that ingest whatever token you paste, which shows up in their TLS-terminating proxy logs, scrolls past coworkers in screen shares, and is generally a small operational-security risk every time it happens. The actual logic is small — JWT decoding is one regex-split + two base64url-decodes + two JSON.parses, the timestamp humanizer is a 20-line switch over Date.now diffs, the HMAC verifier is a 5-line SubtleCrypto call. Owning the page yourself means no ads, no signup, no third-party log entries for your tokens, and a visual signature (brass-bevelled token vault with a lock pill that glows green on verify) that nobody else has shipped.

Common features

• Real-time decode on every keystroke — header / payload / signature panels update without a button press
• Per-segment colour preview line so the three-part shape is one-glance obvious
• Pretty-printed JSON for both header and payload (two-space indent, matches jwt.io)
• Claim humanizer: registered claims (iss / sub / aud / exp / nbf / iat / jti) + OIDC + Auth0 + Okta + Cognito extensions
• Timestamp claims render as ISO datetime + relative-time ("in 4 days" / "expired 12 minutes ago"), ticks once a minute
• Optional HS256 / HS384 / HS512 signature verification via SubtleCrypto
• Lock-pill verify status: Verified (green) / Signature mismatch (amber) / Algorithm-not-HS (err) / Enter secret (neutral)
• Specific parse-error messages (not three parts, header not base64url, payload not JSON, …) with the offending segment number
• URL-hash share link — recipient opens to the same decoded view
• Browser-only — no fetch, no third-party script, no data collection, token never leaves the page

Real-world examples

Why FloopFloop fits jwt debugger projects

The reason jwt.io and friends exist is that wrapping base64url decode + JSON.parse + SubtleCrypto in a webpage is a viable business model — ads, lead capture for the auth-provider operator, and minimal effort, nothing else. The unique thing FloopFloop ships on top of that is the *aesthetic*: a token-inspection vault — three brass-bevelled panels stacked vertically (header / payload / signature) on a deep near-black canvas, with a lock pill in the verify panel that glows green when the HMAC checks out and amber when it doesn't, JetBrains Mono on every code surface, sitting on a colour palette that reads as a literal token vault instead of a one-page docs site. Five colour variants (brass vault, blueprint, terminal green, paper light, gunmetal noir) cover the obvious dev-tribe skin choices without making every JWT tool on the internet look the same. The whole thing is client-side, so the visual IS the differentiator AND the security story: your token never leaves the page, which is the actual reason on-call engineers should stop pasting prod bearers into jwt.io.