JWT Decoder & Signature Verifier
Decode JSON Web Tokens and verify HMAC signatures.
About this tool
A JWT is three Base64URL segments: header, claims, signature. This debugger decodes the first two instantly, renders registered claims (exp, iat, nbf) as human-readable dates with expiry status, and verifies HMAC-signed tokens (HS256/384/512) against a secret you provide.
Unlike hosted debuggers, everything stays on your device — paste production tokens without shipping them to someone else's server.
Like everything on encrypt.tools, this runs entirely in your browser — nothing you enter is transmitted or stored.
Frequently asked questions about JWT Debugger
Is it safe to paste a production JWT here?+
Yes — decoding and signature verification happen entirely in your browser. Unlike some hosted debuggers, your token is never sent to a server.
Can it verify the signature?+
It verifies HMAC-signed tokens (HS256/HS384/HS512) when you supply the secret. RSA/ECDSA (RS/ES) signature verification is not yet supported.
Does decoding a JWT reveal secrets?+
A JWT's header and payload are only Base64URL-encoded, not encrypted — anyone can read them. Never put secrets in a JWT payload; the signature only proves it wasn't altered.