JWT Decoder
Paste a JSON Web Token to read its header and claims, see when it expires, and verify an HMAC signature with your secret.
Header
Payload
Claims
Verify signature
For HS256, HS384 and HS512 tokens. The sample token’s secret is toolgu-demo-secret.
What is inside a JWT
A JSON Web Token has three Base64URL parts separated by dots. The header names the signing algorithm. The payload holds claims such as the user ID (sub), the issuer (iss) and the expiry time (exp). The signature proves the first two parts weren’t changed.
Paste a token to read it, check the expiry against your clock, and confirm an HMAC signature with the shared secret.
Frequently asked questions
Is it safe to paste a real token here?
Decoding and verification run entirely in your browser; the token is never sent anywhere. Still, treat production tokens like passwords and prefer expired or test tokens when you can.
Does decoding prove a token is valid?
No. Anyone can read a JWT’s payload, because it is only Base64URL-encoded. Only checking the signature with the right key proves it wasn’t changed.
Can it verify RS256 or ES256 tokens?
Not yet. Those use public-key signatures; this tool verifies HMAC tokens (HS256, HS384, HS512) with a shared secret, and decodes every type.