JWT Decoder help

Read what is inside a JWT and check whether it has expired. Optionally verify an HMAC signature with the secret.

Decode

Paste a token. The header and payload are shown as formatted JSON. Time claims (exp, iat, nbf, auth_time) are listed as ISO dates, and a badge shows whether the token is valid, expired, or not yet valid.

Verify

If the algorithm is HS256, HS384, or HS512, a verify box appears. Paste the shared secret and it recomputes the signature in your browser and tells you whether it matches.

Notes

• The token and secret are never uploaded. Decoding and verification run in the page.
• RS/ES/PS tokens can be decoded but not verified here, since that needs the public key and more machinery.
• Decoding a token is not the same as trusting it. Only a verified signature tells you it is authentic.

Everything runs in your browser. Nothing you enter or drop is uploaded.