JWT Checker (GitHub)
Paste a JWT or GitHub snippet to extract tokens, decode header/payload claims, and optionally verify HS256/HS384/HS512 signatures locally (no network).
Tip: If you paste a GitHub log or file, leave Mode on Auto-extract to find JWTs inside other text.
How to use
Use it in seconds:
- Paste a JWT or a GitHub snippet containing one into the input.
- Choose Auto-extract (find tokens in text) or Single JWT.
- (Optional) Enter an HMAC secret to verify HS256/HS384/HS512 signatures.
- Click Decode / Check to see decoded JSON + expiry info + signature status.
Note: GitHub App JWTs and GitHub Actions OIDC tokens are commonly RS256; this tool will still decode them, but can’t verify RS/ES signatures without the right public key/JWK.
FAQ
Can this verify JWTs signed by GitHub (RS256)?
No—this page only verifies HMAC JWTs (HS256/HS384/HS512). GitHub-issued tokens are often RS256 and require the correct public key/JWK to verify.
What does “jwt checker github” usually mean?
Most people mean “I found a JWT in a GitHub repo/log—decode it and see claims like exp/iat/kid, and verify if it’s HMAC.”
Is my token sent to a server?
No. The tool runs locally in your browser and does not make network requests.
Why does signature verification say “not supported”?
That happens when the token uses RS*/ES* algorithms or the header is missing/invalid. You can still decode the header and payload.
How do I check if a JWT is expired?
Look at meta.exp_iso and meta.is_expired. The tool compares exp to your current time.
What does “invalid_candidates” mean in auto-extract mode?
It counts dot-separated strings that looked like JWTs but failed to decode into JSON header/payload.
Why should I keep “Include full token in output” off?
So you can share debugging output (claims, timestamps, alg) without accidentally leaking the full credential.
Continue your workflow
Browse related tools by task. Use the improved core tools for a consistent workspace with file import, downloads and clear validation errors.