Fast No server upload JWT/HS256

JWT Decoder Online - Decode JWT & Verify HS256

Decode JWT Header/Payload, exp·iat·nbf, and key claims, and verify the HS256 signature Browser only.

Related tools UUID / NanoID Generator Base64 Encoder & Decoder JSON/XML Formatter & Validator
Processing limit: JWT input up to 1 MB · signature verification supports HS256

Token status

Algorithm
-
Expiration status
-
Issued at
-
Expires at
-

Verify HS256 signature

Enter the secret to verify the signature.

Header

{}

Payload

{}

Claims summary

Decode the JWT to view its key claims.

Reading JWTs Without Confusing Decode and Verify

JWT payloads are usually just Base64URL-encoded claims and can be decoded without a key. That makes decoding useful for inspection but not for trust. Trust requires verifying the signature with the expected algorithm and key, then separately enforcing claims such as issuer, audience, and expiration.

Decoded claims are untrusted until verified

Anyone can construct a token-shaped string with arbitrary header and payload values. Reading sub, role, exp, or other claims tells you what the token says; it does not prove who issued it.

HS256 verification needs the real shared secret

This tool can verify HS256 signatures when you provide the matching secret. A successful signature check proves integrity under that shared key, but you still need application rules for expiration, issuer, audience, nonce, and other claims.

Algorithm support is intentionally limited

RS256 and ES256 use asymmetric keys and are not verified by this HS256-only checker. Do not interpret an unsupported algorithm as a failed or successful verification; use a verifier designed for that algorithm and key type.

Before inspecting a JWT

Helpful information