7 Essential JWT Debugging Tools for Open Finance Development
By OpenFinanceTools · Updated
Corrected September 15, 2026: this overview replaces unsupported compliance and product-feature claims with specific diagnostic uses. The original publication date is retained. Tool choice does not establish regulatory compliance.
Choose a JWT debugging tool according to the question you need to answer. Reading a payload, validating a signature and testing an application's authorization policy are different tasks. A tool that is convenient for one may not address the others.
For a reproducible starting point, use our Node.js JWT verification lab. It exercises a valid token and eight deliberately failing cases with synthetic keys. The overview below is a workflow guide, not a scored benchmark of third-party products.
Quick comparison
| Tool | Useful question | Important limit |
|---|---|---|
| OpenFinanceTools | What fields are in this test token? | Inspection is not a complete application security assessment. |
| jwt.io | Can I inspect the encoded parts interactively? | Do not enter production secrets into a shared workflow. |
| jose | Does my configured verifier accept or reject this token? | Your issuer, audience and algorithm policy still need configuration. |
| jwt_tool | Which JWT security test should I investigate? | Active security testing needs an authorized target and clear scope. |
| CyberChef | Which encoding transformation explains these bytes? | A successful transformation does not prove authenticity. |
| OpenSSL | What key or certificate material am I looking at? | A key inspection command is not a complete JWT verifier. |
| curl | What does my trusted issuer's endpoint return? | An HTTP 200 response does not prove that a key belongs to the expected token. |
1. OpenFinanceTools: inspect the integration artifacts
The JWT Decoder & Validator helps inspect test-token headers and payloads and supports the verification options exposed in its interface. The neighboring PEM Decoder and JWKS Generator help when the investigation turns toward key material.
Start by recording the algorithm and key identifier, then establish the token's intended issuer and recipient from trusted configuration. Do not treat the ability to display claims as proof that those claims are authentic. These utilities do not manage an issuer's key rotation or certify an open banking deployment.
2. jwt.io: a second interactive view
jwt.io provides an interactive JWT inspection interface. It can be useful when you want to compare how another tool presents a synthetic token. Read the current interface and documentation for the supported verification inputs rather than assuming every algorithm or remote-key workflow is available.
If two displays disagree, compare the original token bytes first. Quotes, whitespace or a copied Bearer prefix can change the input. Keep real customer tokens and private keys out of screenshots, tickets and browser-based demonstrations.
3. jose: executable acceptance and rejection tests
jose is the library used by this site's downloadable JWT lab. It lets a test specify the issuer, audience, algorithm policy and required claims, then assert the result. That makes it useful for turning a support incident into regression coverage.
Keep one valid control token and change one thing at a time: audience, expiry, signing key or key identifier. Record the error code, not a pasted token. Pin the library version for reproducibility and review changes before upgrading the fixture environment.
4. jwt_tool: an authorized security-testing workflow
jwt_tool is intended for JWT inspection and security testing. It belongs in a controlled assessment workflow where you understand the selected operation and have permission to test the target.
A finding from a security tool should be reproduced and explained in the application context. Distinguish a deliberately weakened local fixture from evidence that a real service accepts an invalid token. Do not run active tests against a bank endpoint simply because it is reachable.
5. CyberChef: investigate encoding separately
CyberChef is useful for exploring data transformations. In a JWT investigation, it can help isolate whether the confusing part is Base64url, text encoding or another representation issue.
Keep the output of a transformation separate from a trust decision. An apparently valid JSON document can come from an unsigned or attacker-modified input. Use an actual verifier with trusted keys before accepting any decoded claim.
6. OpenSSL: inspect the underlying key material
OpenSSL helps inspect certificates and related cryptographic artifacts. If a JWT integration is configured with the wrong certificate or public key, reading its subject, validity and public-key details can narrow the investigation.
Do not replace a JOSE library with a hand-built shell verification pipeline unless you are deliberately implementing and testing all required processing. JWT verification includes algorithm policy and claim semantics beyond a raw cryptographic operation. The PEM guide covers the inspection stage.
7. curl: inspect a trusted endpoint response
Use curl against a JWKS endpoint obtained from trusted configuration to inspect status, response headers and the returned JSON. This helps distinguish connectivity or caching behavior from cryptographic failures.
Save synthetic or public response data for a regression fixture when appropriate. Never construct an unrestricted server-side fetch from an untrusted token header. A reachable endpoint and a matching key identifier are not sufficient evidence of trust.
A practical debugging sequence
- Establish the expected issuer, token purpose and recipient.
- Inspect a synthetic reproduction in a decoder.
- Check key selection and key material against trusted configuration.
- Run a verifier with explicit policy and inspect the failure category.
- Add a regression case that rejects the bad input while retaining a valid control.
- Test the actual application permissions and consent behavior separately.
For the complete failure lab, expected output and key-rotation investigation sequence, continue to JWT Signature Verification Failed?. For the wider protocol flow, read FAPI 2.0 for Open Banking Developers.