KOENJP

JWT Decoder & Signature Checker

JWT · DECODE · HS256

Paste a JWT to decode its header and payload into readable JSON, with exp, iat and nbf shown as dates plus expired or time left. Verify HS256, HS384 and HS512 signatures with a secret. Your token never leaves the browser.

Token

Decoded in your browser only. Your token is never sent or stored anywhere. Signature checks run on the browser's WebCrypto.

Good to know. Don't paste production secrets or live tokens; use test tokens instead. Decoding only reads the contents. Only the key can tell you whether the signature is genuine. Public-key signatures (RS, ES, PS) and encrypted tokens (JWE) aren't checked.

HOW TO

How to use

  1. Paste a JWT (it starts with eyJ…). A leading Bearer is fine.
  2. The header and payload appear as formatted JSON, each with its own copy button.
  3. Check the summary for the algorithm, exp, iat and nbf dates, and whether it has expired or how long it has left.
  4. For HS256, HS384 or HS512 tokens, enter the secret and press Verify to check the signature.
FAQ

FAQ

Is my token sent to a server?

No. Decoding and signature checks both run in this browser, and neither the token nor the secret is stored. Still, use test tokens rather than production secrets or live tokens.

If it decodes, is the token genuine?

Not necessarily. The header and payload are just Base64URL text, not encryption, so anyone can read them. Only checking the signature with the key proves it's genuine.

Can it verify RS256 or ES256 tokens?

Only HMAC algorithms that use a shared secret (HS256, HS384, HS512) are verified. Public-key tokens can still be decoded.

Which time zone are the dates in?

exp, iat and nbf are Unix seconds, shown in this device's time zone. The time left is recalculated every second.