Support the project Main site 繁體中文
Crypto & Security / Token inspection

JWT Token Decoder & Verifier

Decode JWT header, payload and signature locally, inspect exp and verify HS256 signatures with a local secret.

Back to Converter HubWeb Crypto Local browser processing

JWT token decoder and verifier

Paste a JWT to inspect its three segments, claims and expiry; optionally verify an HS256 signature with a local secret.

Progress0%

JWT parsing stays local; decoding a token does not mean its signature is verified.

Decoded Header

—

Decoded Payload

—
Signature—

Expiry and claims: —

Features and quick guide

JWT Token Decoder & Verifier

Useful for debugging token claims, exp timestamps and signature configuration.

3-step quick guide

  1. 1
    Paste a JWT.
  2. 2
    Decode the header, payload and exp claim.
  3. 3
    Optionally enter an HS256 secret and verify the signature.

Privacy promise

Files and text stay in this browser tab; no upload endpoint is used.

No login or server-side file processing is used.

Frequently asked questions

Can a JWT hide secrets?

JWT header and payload data is normally readable; never place passwords or private keys in a payload.

How is expiry checked?

The tool treats exp as Unix seconds and compares it with the current browser time.

Are all algorithms verified?

Local verification currently supports HS256. Other algorithms can be decoded structurally but are not claimed to be signature-verified.