Processed locally in your browser

JWT Decoder

Decode and debug JSON Web Tokens.

Send feedback

Tell us what worked, what did not, or what could be better.

Sends this feedback, this page, and language to the ToolHub inbox. Tool input is never included.

Verify HMAC signature

About

Inspect JWT headers, payloads, and time claims, and optionally verify HS256, HS384, or HS512 signatures with a shared secret.

Key Features

  • JWT header and payload
  • HS256 / HS384 / HS512

How to use

  1. 1Paste a three-part compact JWT and decode it.
  2. 2For an HMAC token, enter the shared secret and verify the signature.

Example

Input

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMiLCJleHAiOjQxMDI0NDQ4MDB9.signature

Output

alg=HS256 · sub=123 · exp=2100-01-01T00:00:00Z

Limitations

  • Input is limited to 2,000,000 characters to keep the browser responsive.
  • Decoding never proves authenticity. Only supported HMAC algorithms can be verified; RSA, ECDSA, JWKS, and remote keys are not fetched.
  • All input is processed locally in your browser and is never uploaded to ToolHub.

Standards and references

Last reviewed:

Related Tools

HMAC Generator
Base64 Converter
JSON Formatter
Hash Generator