JWT Claims Token Decoder
Decode JWT header and payload, check expiry, and verify HS256/384/512 signatures locally.
Why use this tool?
Decode a JSON Web Token to inspect its header and claims, see whether it has expired, and verify HMAC (HS256/384/512) signatures with your secret - all in your browser.
How to use it
- Paste the JWT.
- Review the header, payload and expiry.
- Optionally enter the secret to verify the signature.
What's inside a JWT
A JSON Web Token is three Base64URL-encoded parts separated by dots: a header (which algorithm signed it), a payload of claims, and a signature. The decoder shows the header and payload as readable JSON. Standard claims include sub (who the token is about), iss (who issued it), aud (who it's for), iat (issued at), nbf (not valid before) and exp (expiry). Times are Unix timestamps, which the tool converts and uses to tell you whether the token has expired.
Decoding happens in your browser. That matters because tokens are credentials: pasting a live token into a site that uploads it hands over access to the account it belongs to.
Decoding is not verifying
Anyone can decode a JWT; the payload isn't encrypted. What makes a token trustworthy is its signature, which proves it was issued by someone holding the key and hasn't been modified. Never trust claims (like "admin": true) from a token you haven't verified.
For HMAC tokens (HS256, HS384, HS512), enter the shared secret and the tool verifies the signature locally using your browser's crypto engine. Tokens signed with public-key algorithms (RS256, ES256 and similar) can be decoded here but not verified, since that needs the issuer's public key. Tokens with "alg": "none" have no signature at all and should always be rejected by servers.
Debugging tips
"Token expired" errors: compare exp with the current time, and remember servers may allow a little clock skew. "Invalid audience" or "issuer": check aud and iss against what the API expects. If the signature fails with the right secret, check whether the secret is meant to be used as plain text or is itself Base64-encoded; both conventions exist.
Keep tokens short-lived and don't put sensitive personal data in the payload, because anyone who sees the token can read it.
Frequently asked questions
Is it safe to paste my token here?
The token and secret stay in your browser and aren't sent anywhere. Still, treat live tokens like passwords and prefer expired or test tokens when debugging.
Can anyone read my JWT?
Yes. The header and payload are only encoded, not encrypted. The signature prevents tampering, not reading.
Why can't I verify an RS256 token?
RS256 uses a public/private key pair. This tool verifies HMAC (HS256/384/512) signatures with a shared secret only.