Dashboard
JWT Token Decoder
JWT Token Decoder & Inspector
Decode and inspect JSON Web Tokens locally. Real-time expiration countdown and claims auditing.
100% Offline
Business
Paste Token
Verify Signature (HMAC-SHA256)
Enter the secret key to verify if the token signature is valid:
No Signature Loaded
Token Integrity & Audit
Status:
Active
Expiry Time:
-
Time Remaining:
-
Header (Algorithm & Type)
{}
Payload (Data Claims)
{}
Standard Claims Reference
iss (Issuer)
Identifies the principal security authority that issued the JWT token.
sub (Subject)
Identifies the user, resource, or entity (subject) this token is authenticating.
exp (Expiration Time)
Identifies the expiration time after which this token is rejected.
aud (Audience)
Identifies the intended recipients or backend clients of this token.
Frequently Asked Questions
Quick direct-answer guides about using this utility tool locally and securely.
Can I decode signatures signed with RS256 private keys?
The decoder can display and decode the headers and JSON payload claims for any RS256/ES256 token. However, signature validation is currently supported for HMAC-SHA256 (HS256) secrets.
How secure is inspecting security tokens on this site?
Since parsing uses client-side base64url decoding functions, sensitive tokens containing client keys, passwords, or emails are never sent across the network.