Why can I read the payload without a key?

Because a signed JWT is not encrypted. The signature protects integrity — it proves the token has not been altered and came from a holder of the key — but the header and payload are only base64url-encoded, which is a reversible transport encoding. Anyone with the token can read them.

Does this tool tell me whether the token is valid?

Not by itself. The page confirms structure, shows the claims, and can compare HS256, HS384, or HS512 when you supply a shared secret. It does not support public-key algorithms or enforce issuer, audience, time, nonce, scope, and application authorization rules, so it is a diagnostic rather than a production validity decision.

Is it safe to paste a real token here?

The decoding is local and nothing is transmitted. The wider risk is not this page but the copy itself: a live token in your clipboard can end up in a paste buffer, a chat message or a bug report. Use an expired or test token when you can, and rotate anything you have handled carelessly.

What should I put in a JWT payload?

As little as possible — an identifier, the claims your API needs to authorise the request, and the standard time and audience fields. Because the payload is readable by anyone holding the token, personal data and secrets do not belong there, and every extra claim is sent on every single request.

Which JWT signatures can this page verify?

It can recompute HMAC signatures for HS256, HS384, and HS512 when you supply the shared secret. It does not verify RSA, ECDSA, EdDSA, none, encrypted JWE tokens, or provider-specific key discovery.

Does a matching HMAC signature validate every claim?

No. A match checks integrity with the supplied secret; it does not prove the secret is the issuer's current key or enforce expiry, not-before, issuer, audience, subject, nonce, scope, or application policy. Your authentication library must validate all required claims.

JWT Decoder and HMAC Signature Checker

Overview

Read JWT claims first; verify only the HMAC case this page supports

Split a three-segment JWT, decode its JSON header and payload, explain common claims, and show exp or nbf relative to the browser clock. When the header declares HS256, HS384, or HS512, a supplied secret is checked locally; public-key algorithms and the wider authorization context are not verified here.

Three segments explained

Header and payload are decoded as UTF-8 JSON while the signature remains visible as base64url text.

HMAC verification

Web Crypto checks HS256, HS384, or HS512 against the exact secret entered in the page.

Time claims made readable

exp, nbf, and iat display as local dates with relative timing; the clock refreshes every 30 seconds.

Segment-level copy

Copy an encoded segment, decoded header, decoded payload, or signature independently.

How it works

Using JWT Decoder, start to finish

Three steps, in the order the tool above actually takes them.

1
Paste a test or expired token
Avoid live bearer credentials where possible; the page requires exactly three dot-separated segments.
2
Read header, claims, and time
Check alg, typ, standard claim meanings, and whether exp or nbf is relevant to the current browser clock.
3
Verify the supported signature
For HS256/384/512 only, enter the expected secret and distinguish a matching signature from a merely decoded token.

Use cases

What people bring here

The jobs this page is usually opened for, and the setting that makes each one quick.

Debugging an expired session

Inspect exp, nbf, issuer, subject, and audience without sending the token to a decoder service.

An unexpired time claim does not prove the signature, issuer, audience, or server-side session is valid.

Checking an HMAC test token

Confirm that a known test secret reproduces the signature for HS256, HS384, or HS512.

Do not paste a production signing secret into general-purpose tooling, even when processing is local.

Explaining token contents

Show why signed JWT header and payload segments are readable without a decryption key.

Never place passwords, private keys, or unnecessary personal data in a signed-but-unencrypted payload.

Three separate questions

Readable, correctly signed, and acceptable to an application are different states

Decoding establishes structure. Supported HMAC verification establishes a signature match for one secret. The application must still enforce issuer, audience, time, subject, revocation, and authorization policy.

Check	What it establishes	What remains open
Decode succeeds	The token is genuine and safe to trust.	Only the two JSON segments were readable and structurally valid.
HMAC matches	Every claim is acceptable to every service.	The signature matches that secret; policy validation remains application-specific.
exp is in the future	The token is valid now.	It is not expired by this browser clock; nbf, issuer, audience, signature, revocation, and server policy still matter.
RSA or ECDSA alg	The absence of a secret field means the signature passed.	This page does not accept public keys or verify those algorithms.

Decode succeeds

The token is genuine and safe to trust.

Only the two JSON segments were readable and structurally valid.

HMAC matches

Every claim is acceptable to every service.

The signature matches that secret; policy validation remains application-specific.

exp is in the future

The token is valid now.

It is not expired by this browser clock; nbf, issuer, audience, signature, revocation, and server policy still matter.

RSA or ECDSA alg

The absence of a secret field means the signature passed.

This page does not accept public keys or verify those algorithms.

Privacy

Where your work is processed

The token and optional HMAC secret stay in component memory and are never uploaded or autosaved. Use test or expired credentials whenever possible.

Source content stays in the tab

Encoding, parsing, formatting, generation, comparison, and cryptographic operations run in browser code. Form values and uploaded text files are not sent to a processing API.

Inputs are not autosaved

Code, tokens, secrets, URLs, and generated outputs stay in component memory until the page reloads or closes. Split-pane tools remember only the divider percentage for the current tab session.

Clipboard and downloads are explicit

The page reads the clipboard only after a Paste action and writes it only after Copy. A local download is created only when you choose the tool's download control.

One aggregate page view may be counted

The page shell can send the tool slug, never the editor contents or filename. The endpoint is rate-limited using a transient requesting address and is skipped for Do Not Track or Global Privacy Control.

More detail in how processing works and our privacy policy.

Limits

Decoder and verifier boundaries

The values this tool actually enforces, not a rounded-up version.

Structure: 3 segments; Header and payload must decode to JSON.
Verification: HS256 / 384 / 512; HMAC only, using a locally entered secret.
Clock refresh: 30 seconds; Time badges use the browser clock and numeric exp or nbf claims.
JWE: Not supported; Encrypted token contents are not decoded.

No RSA/ECDSA verification, issuer policy, audience policy, or authorization decision

The page decodes compact three-segment JWTs and can verify HS256, HS384, or HS512 only when you provide the matching shared secret. It does not verify RSA, ECDSA, EdDSA, none, remote JWKS, or encrypted JWE tokens; it cannot sign or construct a token and does not enforce application claim policy.

FAQ

JWT decoding and verification questions

The ones that actually come up.

Developer tools

Choose a neighboring tool for the next step; each page states its processing and limits up front.

Base64 Encoder / DecoderRound-trip UTF-8 text through standard Base64, with invalid input reported clearly.Open URL Encoder / DecoderPercent-encode one URL component with encodeURIComponent, or decode it back.Open JSON FormatterA full JSON workspace for formatting, repair review, queries, conversion, and comparison.Open JSON Repair ProA repair review for malformed and AI-generated JSON, with a named rule behind every change.Open JSON to TypeScriptInfer TypeScript interfaces from one JSON example, with sampling limits stated.Open CSV to JSON ConverterA full data workspace for parsing, mapping, inspecting, cleaning, and converting tabular data.Open

Guides

Reading that goes deeper

JSON Web Tokens (JWT): How They Work and How to Use Them SafelyA beginner-friendly guide to JSON Web Tokens: what a JWT contains, how signing works, common use cases, and the security practices that keep tokens safe.Read What is JSON and how to format it correctlyA practical guide to JSON syntax, the mistakes that break it, and how a formatter turns a wall of text into something you can actually debug.Read