JWT Checker
JWT checker to decode header/payload, inspect claims (exp/nbf/iat), and verify HMAC signatures (HS256/HS384/HS512) locally in your browser—no network calls.
header.payload.signature{}
How to use
Use this checker to quickly inspect what a JWT contains and whether it’s valid for the current time.
- Paste the full token (
header.payload.signature) into the JWT field. - (Optional) Enter the shared secret if the token uses
HS256,HS384, orHS512. - Click Decode / Verify to view header/payload and signature status.
- Review claim times (exp/nbf/iat) and any warnings.
FAQ
Does this JWT checker verify signatures?
It verifies HMAC tokens (HS256/HS384/HS512) if you provide the secret. For RSA/EC algorithms (e.g., RS256/ES256), it decodes but does not verify.
Is my token sent to a server?
No. The tool runs locally in your browser and does not make network requests.
Why does it say “Decoded (secret missing)”?
The token uses an HMAC algorithm, but no secret was entered, so the signature can’t be checked.
What does alg=none mean?
It means the token is unsigned. This is usually insecure unless your system explicitly allows it.
How are exp/nbf/iat interpreted?
They are treated as epoch seconds per JWT conventions and displayed in UTC and local time.
Why does signature verification fail even with the right secret?
Common causes are a different secret than the issuer used, token modification, or mismatched algorithm (e.g., HS256 vs HS512).
Can I use this to validate authorization headers (Bearer tokens)?
Yes—paste only the JWT part (without the Bearer prefix) to decode and verify.
Continue your workflow
Browse related tools by task. Use the improved core tools for a consistent workspace with file import, downloads and clear validation errors.