JWT Decoder
Decode a JSON Web Token and optionally check an HMAC signature locally.
Everything runs in your browser. Files and text are not uploaded or saved.JWT
How to Use
- Paste a token with three dot-separated parts.
- Read the header and payload.
- To check HS256, HS384, or HS512, enter the secret and verify.
- Reset clears the token and secret.
FAQ
Is the token sent to a server?
No. Decoding and HMAC checks stay in this browser.
Are RSA signatures checked?
No. Only HMAC secrets can be checked here.
What does exp mean?
If the exp claim is in the past, the page says so.