Common uses
- Inspect token claims while debugging authentication flows.
- Check expiration, issuer, audience and subject values.
- Verify an HMAC token during local development or API testing.
Decode & Verify JWT Tokens
Inspect a JWT and optionally verify HS256, HS384 or HS512 signatures.
Processed locally. Never uploaded.
Tokens and secrets stay in this browser
Optional signature verification
For HS256, HS384 or HS512, enter the original secret. Decoding alone does not establish trust.
Decoded header and payload will appear here.
How it works
Done in three quick steps
- 1
Paste a JWT token.
- 2
Decode its header and payload.
- 3
Optionally enter the HMAC secret to verify its signature.
About this tool
What you can do with JWT decoder & verifier
The JWT decoder reads Base64URL-encoded header and payload data and presents the claims in a readable form. For HMAC tokens, optional signature verification can confirm whether the token matches a supplied HS256, HS384 or HS512 secret.
Tips for better results
- Decoding a token does not prove that it is authentic; verify its signature before trusting it.
- HMAC verification does not support RSA or elliptic-curve JWT algorithms.
- JWT exp and nbf timestamps are expressed as Unix time in seconds.
Good to know
Frequently asked questions
Clear answers about privacy, quality and how this tool works.