JWT Decoder

Look inside a login token

See what a JWT says and when it expires, and check HMAC signatures.

Paste your token

Token

What it says

Header

Payload

Check the signature

Secret, to verify an HS256/384/512 signature (optional)

This all happens on your device. Nothing you type or add is sent anywhere. Check it yourself

Is it safe to paste a real token?

Safer than most: it's decoded in this tab and the page's security policy blocks any outside connection. Still, treat live tokens like passwords and revoke any you've shared.

Can it verify RS256 tokens?

Not yet. Those need the issuer's public key; HMAC tokens (HS256 and friends) can be checked with your secret now.

About this tool

Runs	In your browser. Your files stay on your device.
Engine	Web Crypto API
Verifies	HS256, HS384, HS512 with a shared secret
Works offline	Yes, once the page has loaded
Licence	AGPL-3.0
Added	28 September 2026
Built by	Sapience Design
Source	tools/developer/jwt-decoder

Report a problem

Look inside a login token

Paste your token

What it says

Check the signature

AI agent activity

Suggest a tool

Step 1 of 3 What should the tool do?

Step 2 of 3 Anything else?

Step 3 of 3 Want it sooner?

Thank you!