← Back to Generator

🔍 JWT Decoder

Paste a token below to inspect its header, payload and expiration — or verify its HMAC signature. Everything runs locally in your browser.

Header

RED
Waiting for a token…

Payload

PURPLE
Waiting for a token…

Claims & Timing

🔐 Signature Verification (HS256 / HS384 / HS512)

Enter the secret key used to sign this token. Verification is computed locally with the Web Crypto API — the secret is never sent anywhere. Note: RS256 / ES256 tokens require a public key and are not supported here.

⚠️ Privacy reminder: the payload is only Base64URL-encoded, never encrypted — anyone who sees the token can read it. Use sample or test tokens here; avoid pasting production tokens that contain sensitive claims. Nothing you paste is stored or transmitted.