JWT Decoder
Paste a token to read its header, payload and time-based claims, and verify an HS256 signature locally with your shared secret. No request is made at any point — there is no backend here that could receive it.
The token never leaves this page. This site is static assets with no backend that could receive it — open your network panel and watch: decoding makes zero requests.
Header
—Payload
—Verify locally (HS256/384/512)
Signature
What is inside a JWT, and what it does not promise
Three base64url segments separated by dots: the header names the algorithm, the payload carries the claims, the third is the signature. The first two are encoded, not encrypted — anyone holding the token can read them, which is why a payload should never carry a password or a national id. A signature proves the token was not altered; it does not hide anything.
Most people open a decoder to check expiry. The table above resolves
exp,
iat and
nbf into real times with a
countdown. All three are Unix seconds, not milliseconds — mixing that up by three orders of
magnitude is the classic false lead when debugging auth.
Verification covers HS256/384/512, because a symmetric secret is what a browser can check: WebCrypto
computes the HMAC and compares it. RS/ES/PS need the issuer public key or JWKS, so those are reported
as not verifiable here rather than quietly passing. And if the header says
alg: none the page warns you —
that is a textbook vulnerability: a server that does not pin an algorithm allowlist will accept a
forged token.
Why the "stays local" claim matters: what people paste into a decoder is usually a real production token. This site is static assets on a Cloudflare assets-only Worker with no server-side code, so there is physically no endpoint that could accept it. Open the network panel and paste — zero requests.