Does it verify the signature too?

If you enter a secret key, the HS256 signature can be verified right in your browser. Without a secret, only the header and payload are decoded and shown.

Does it verify asymmetric algorithms like RS256?

Currently only HS256 (symmetric-key) signature verification is supported. For RS256 and others, only header/payload decoding is available.

Is the token or secret I enter sent to a server?

No. Both decoding and signature verification (Web Crypto API) are handled entirely in your browser.

🪪 JWT Decoder

Paste a JWT to see its header and payload; enter a secret to also verify its HS256 signature.

JWT

HS256 Secret (optional, for signature verification)

How to use

Paste a JWT string.
The header and payload are decoded and shown instantly.
To also check the signature, enter the HS256 secret.

🎯 Use Cases

Check the expiration time (exp) of a token issued after login — verify when a session expires and whether refresh logic fires in time
Inspect the payload while debugging a backend auth bug — confirm custom claims like role or permissions were set as intended
Quickly verify locally whether a signing secret is correct — test whether a JWT_SECRET environment variable matches the one used to actually issue tokens
Understand the structure of a token from a third-party API or SSO integration — inspect an undocumented claim structure firsthand to design your parsing logic

Example

Input

JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE3MDAwMDM2MDB9.dbgl-1IyaylYQy8Qi72rq4rccV2SP1uxfEMWpg5mskU
HS256 Secret: my-secret-key

Output

HEADER  { "alg": "HS256", "typ": "JWT" }
PAYLOAD { "sub": "1234567890", "name": "Alice", "role": "admin",
          "iat": 1700000000, "exp": 1700003600 }
Issued at (iat): 11/15/2023 / Expires (exp): 11/15/2023
✅ Signature is valid

Pasting this HS256-signed token decodes its header and payload and shows the exp/iat timestamps in human-readable form. Entering the correct secret (my-secret-key) verifies the signature as valid.

JWT registered claims

A JWT payload can hold any custom fields you want, but it's common to also see the standard "registered claims" defined by RFC 7519. This tool automatically converts the time-related claims below into a human-readable date.

Claim	Meaning	Format
iss (issuer)	Who issued the token	String
sub (subject)	What the token is about (usually a user ID)	String
aud (audience)	Who the token is intended for (which service)	String/Array
exp (expiration)	Expiration time — the token is invalid after this	Unix timestamp (seconds)
nbf (not before)	The token isn't valid before this time	Unix timestamp (seconds)
iat (issued at)	When the token was issued	Unix timestamp (seconds)

FAQ

Does it verify the signature too?: If you enter a secret key, the HS256 signature can be verified right in your browser. Without a secret, only the header and payload are decoded and shown.
Does it verify asymmetric algorithms like RS256?: Currently only HS256 (symmetric-key) signature verification is supported. For RS256 and others, only header/payload decoding is available.
Can I trust a token just because it decodes fine, without verifying it?: No. A decoded payload without signature verification is just unpacked base64url — anyone can tamper with it. You must verify the signature with a secret (or the server's public key) before trusting the contents.
Is the token or secret I enter sent to a server?: No. Both decoding and signature verification (Web Crypto API) are handled entirely in your browser.