Authentication troubleshooting
JWT Debugger
Investigate why a JWT that decodes correctly can still fail authentication or authorization.
Token and expected values are evaluated locally in your browser.
Why a readable JWT can still fail authentication
A JWT can decode correctly while failing time, issuer, audience or signature checks.
Authorization may also fail because required scopes or roles are missing.
Use trusted key material when signature verification is required.
Common 401 causes
Expired token, wrong issuer, wrong audience, invalid signature, not-yet-valid token or malformed Authorization header.
Common 403 causes
Authentication succeeds but required scopes, roles or permissions are missing.
Advanced JWT and identity tools
JWT Security Analyzer
Inspect a JWT for policy-sensitive security signals such as alg=none, unexpected algorithms, token-controlled key URLs, suspicious kid values, time claims, issuer and audience mismatches.
JWT Diff
Compare two JWTs field by field to see what changed in the decoded header and payload after refresh, login, environment changes or key rotation.
Recommended JWT debugging guides
These are the guides I use most when a decoded JWT still fails at runtime.
How I Debug a JWT 401 Unauthorized Error
Diagnose authentication failures.
Read guide →How I Debug a JWT Audience Mismatch
Confirm whether the token targets the wrong API.
Read guide →How I Debug JWT Issuer Validation and iss Mismatches
Verify the expected issuer.
Read guide →How I Fix a JWT Expired Token Error
Separate expiration from broader authentication failures.
Read guide →