JWT Inspector

Decode a JSON Web Token, see when it was issued and when it expires, and verify an HMAC signature with your secret.

Decoded locally. Your token is never sent anywhere: this page has no server and its security policy blocks all network requests. Still, treat real production tokens like passwords.

Encoded token

Waiting for a token

Verify signature HS256 / HS384 / HS512

Enter the secret to verify

The secret is never stored. RSA / ECDSA tokens (RS256, ES256…) can be decoded but not verified here.

Status

—

Header

Payload