JWT Decoder
Paste a JSON Web Token to decode its header and payload, inspect the claims, check expiry, and verify the signature, all in your browser. Open DevTools → Network and confirm: nothing leaves your tab.
Algorithm: —
Need to compute the expected signature yourself? Use the HMAC Generator with your secret and the header.payload string.
About JSON Web Tokens
A JSON Web Token (RFC 7519) is three Base64url-encoded parts joined by dots: header.payload.signature. The header names the signing algorithm, the payload carries the claims (subject, issuer, expiry…), and the signature lets the recipient confirm the token was issued by someone holding the key. A JWT is signed, not encrypted: anyone can read the header and payload, so never put secrets in the claims.
Registered claims worth checking
exp— expiration time (Unix seconds). A token pastexpmust be rejected.nbf— not-before time. The token is invalid before this instant.iat— issued-at time, useful for token age policies.iss/aud/sub— issuer, audience and subject; verify they match what you expect.
Verify or forge an HS256 signature manually
The signing step of a symmetric token (HS256 / HS384 / HS512) is exactly an HMAC-SHA-256/384/512 over base64url(header) + "." + base64url(payload), with the result Base64url-encoded. To reproduce or check that signature byte-for-byte with your own secret, use the HMAC Generator: paste the header.payload string as the message and your secret as the key. Asymmetric algorithms (RS*, ES*, PS*) sign the same input but with a private key, so you verify them here with the matching public key.
Is anything uploaded?
No. Decoding is plain Base64url; signature verification uses the browser's native crypto.subtle.verify. The token, your secret and any key stay in this tab. Open DevTools → Network and watch: there are no requests.