Helpful information

A JWT consists of a header, payload, and signature. This tool displays its JSON, algorithm, expiration and issue times, and permission claims in a readable form.

Input never leaves your device. Processing uses your local computer only.

JWT decoding and HS256 verification happen entirely in your current browser. Nothing is sent to the MISCLAND server.

Q. Does signature verification support every algorithm?

Only HS256 (HMAC-SHA256) signature verification is supported. Public-key verification such as RS256 or ES256 and JWKS/OIDC key lookup are not supported.

Q. Why does the expiration time look wrong?

The exp, iat, and nbf claims in a JWT normally use Unix time in seconds. Tokens that incorrectly use milliseconds may display unexpected dates.

Q. Is it safe to paste a token here?

Although processing is local, take care when screen sharing or copying production tokens to the clipboard.

Q. Can I edit the payload and create a token?

This tool is for decoding and verification. Token generation should be handled separately and carefully for security.

Troubleshoot login issues: Check exp and nbf to quickly identify expired tokens or tokens that are not valid yet.

Review permissions: Inspect the role, scope, and permissions claims when troubleshooting authorization issues.

Format JSON: Copy the payload to the JSON/XML Formatter for a more detailed review.

Verify: For an HS256 token, enter the secret to verify its signature.

JWT decoding reads the Header and Payload from Base64URL without a key. HS256 signature verification recalculates HMAC-SHA256 over header.payload with the secret and compares it with the token signature. A token being decodable does not mean it is trusted or verified.

No. Signature verification currently supports HS256 only. RS256/ES256 public-key algorithms, JWKS/OIDC key lookup, and iss/aud policy validation are not supported. exp, iat, nbf, and key claims are displayed for inspection; use a server-side JWT library for complete authentication validation.

JWT Decoder Online - Decode JWT & Verify HS256

Token status

Verify HS256 signature

Header

Payload

Claims summary

Helpful information

What can I inspect in a JWT?

Where is the token processed?

Frequently asked questions (FAQ)

Tips

What is the difference between decoding a JWT and verifying its HS256 signature?

Does this JWT Decoder verify RS256, ES256, or iss and aud?