JWT 디코더 & 서명 검증
Paste a JWT (three dot-separated segments) to decode the Header and Payload JSON and turn exp (expiry), iat (issued at) and nbf (not before) into readable UTC times.
For HS256/384/512 tokens, supply the secret to verify the signature locally. Decoding and verification run in your browser — the token and secret never leave your device.
Features
- Header / Payload — base64url-decode both segments and pretty-print them for inspection.
- Readable times — exp/iat/nbf become ISO 8601 times so you can see expiry at a glance.
- Symmetric verify — With a secret, verify HS256/384/512 signatures locally, live.
- Local first — No backend involved; token and secret are processed only on your device.
How to use
- Paste the full JWT (three segments joined by ".") on the left.
- The decoded Header, Payload and time fields appear on the right immediately.
- To verify a signature, enter the HS algorithm secret in the Signature verification box.
FAQ
Does decoding a JWT prove identity?
No. Decoding only makes the content readable; anyone can decode a JWT. Trust depends on the server checking the signature with its key. This tool only does a local HS verification when you provide a secret; RS/ES algorithms are not verified here.
Why does it still say not verified with a secret?
Only alg values of HS256/384/512 are verified with the secret. For RS256/ES256 and other asymmetric algorithms the signature must be checked with a public key on the server, which the browser cannot do safely — the tool says so explicitly.
If exp has passed, is it definitely invalid?
Yes, exp is the expiry time and servers reject expired tokens. This tool only decodes and displays; whether a token is accepted is always up to your server.