JWT Decoder & Debugger – Verify HMAC Signatures Online

JWT Debugger

Signature valid

Token

Signature

HMAC secret

Algorithm: HS256Parts: 3Signature valid

sub42

iat6/1/2024, 8:20:00 AM (2 years ago)

exp6/1/2028, 8:00:00 AM (in 2 years)

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "42",
  "name": "Ada",
  "iat": 1717230000,
  "exp": 1843459200
}

What is the JWT Decoder?

The JWT Decoder splits a JSON Web Token into its header, payload and signature and shows every claim in readable JSON. It converts exp, iat and nbf timestamps into dates, and verifies HMAC signatures (HS256, HS384, HS512) with your secret, all locally in the browser so tokens never leave your machine.

How to use it

Paste the token (the three dot-separated parts).
Read the decoded header and payload claims.
Enter the HMAC secret to verify the signature.

Features

Header and payload decoded to formatted JSON
exp, iat and nbf shown as human-readable dates
HS256, HS384 and HS512 signature verification
Works offline; tokens are never sent anywhere

Frequently asked questions

Is my token sent to a server?

No. The tool runs entirely in your browser with JavaScript. Your token never leaves your device, nothing is logged, and it keeps working offline once the page has loaded.

Can anyone read the contents of a JWT?

Yes. The header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can decode them. Never put passwords or sensitive personal data in JWT claims.

Which signature algorithms can it verify?

It verifies HMAC tokens signed with HS256, HS384 and HS512 using the shared secret you enter. Tokens signed with RSA or ECDSA keys (RS256, ES256) can still be decoded, but not verified here.

How do I check if a JWT has expired?

Paste the token and look at the exp claim. The decoder converts that Unix timestamp to a readable date so you can compare it with the current time.

JWT Decoder and Debugger