Decode JWT header and payload, check expiry, and verify HS256 signatures — 100% client-side.
Also searched as: jwt token decoder · json web token decoder · jwt inspector · jwt parser · jwt debugger
Step-by-step guide to get the most from this tool
Paste the full JWT string (three dot-separated parts).
Read header algorithm and payload claims with timestamps.
See if the token is valid or expired.
Enter shared secret and click Verify signature for HMAC tokens.
What makes this tool stand out
Header and payload as readable JSON.
Valid/expired status with countdown.
Client-side HMAC signature check.
Copy header or payload JSON.
Human-readable exp, iat, nbf.
No server requests.
More free utilities you might find useful
Quick answers to common questions
JWT (JSON Web Token) has three Base64URL parts: Header.Payload.Signature for transmitting claims securely.
Processing is client-side only, but never paste valid access tokens with sensitive claims. Revoke first if unsure.
Yes for HS256. Enter the shared secret to verify HMAC signatures in your browser.
Expiration time as Unix timestamp. The tool shows human-readable dates for exp, iat, and nbf.
RS256 needs a public key. This tool verifies HS256 (symmetric) secrets client-side.
A red banner shows expiry date. Expired tokens should be rejected by your API.
Yes. Use Copy on each section to get formatted JSON.
No. Decode and verify run entirely in your browser.
Your data is processed entirely in your browser. Nothing is sent to any server.