JWT Decoder
Decode the header and payload of a JSON Web Token, check its time claims and optionally verify an HMAC signature. Everything runs locally in your browser — the token and secret are never sent anywhere.
Token
Verify signature (optional)
The secret stays in this browser tab. Enable the checkbox when the signing key is supplied as base64 (standard or base64url). Only HMAC algorithms are supported here; asymmetric signatures are not verified.
Result
Paste a token and click Decode
Important
- Decoding alone does not verify a token. The optional verifier supports HS256, HS384 and HS512 only.
- The payload is only base64url-encoded, so treat token contents as readable. Tokens may contain sensitive data.
- If your signing key is base64-encoded, tick the checkbox so the decoded bytes are used as the HMAC key.
- Time claims use your device clock. A passed
exp/nbfcheck is not a substitute for server-side validation. - This decoder never transmits the token or secret — everything is processed in your browser.