FREE WEB TOOL

JWT decoder

Decode JWT header and payload locally and optionally verify HMAC signatures for HS256, HS384, or HS512.

Use tool

JWT

With a shared secret, HS256 / HS384 / HS512 HMAC signatures can be checked. Public-key algorithms are not verified here.

How to use it

Decode the JWT header and payload locally. When needed, you can also check HS256 / HS384 / HS512 HMAC signatures with a shared secret.

Paste the JWT.
Leave the secret blank for decode-only inspection; enter a shared secret only when you need HMAC verification.
Review the Header / Payload, time claims, and signature status.

Reads: JWT Header / Payload
Time claims: iat / nbf / exp
HMAC verification: HS256 / HS384 / HS512
Not supported: Public-key algorithms such as RS / ES / PS

For inspection work, prefer test tokens and test secrets rather than pasting a production shared secret into a web page.

Readable does not mean trustworthy

A JWT can contain a payload such as admin: true, and this tool can show it. That alone does not prove that a trusted issuer signed the token or that it has not been modified.

Authenticity requires separate verification of the signature, algorithm, key material and expected issuer/audience rules.

JWT contents are not necessarily encrypted

Typical JWT headers and payloads are Base64URL-encoded, which is an encoding rather than a secrecy mechanism. Treat the claims as readable by anyone who obtains the token.

HMAC verification is optional

When you provide a shared secret, this page can verify HS256 / HS384 / HS512 HMAC signatures. Public-key algorithms such as RS / ES / PS are not verified here.

exp and nbf are Unix timestamps

exp commonly marks expiration and nbf the “not before” time. The helper can compare them with the current time, but the receiving application still decides how those claims are enforced.

iss and aud matter during validation

iss identifies the issuer and aud the intended audience. Even a correctly signed token can be rejected when those values do not match what the application expects.