Sign a JSON payload as an HS256 JWT with a secret, in the browser
JWT Decoder
Runs locally
Use JWT Decoder
What it does
Decode the header and payload of a JSON Web Token and see its algorithm and expiry time. Decoding is not verification: anyone can create a token with any claims, and this tool does not check the signature.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Expired HS256 token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkV4YW1wbGUgVXNlciIsImlzcyI6Imh0dHBzOi8vbG9naW4uZXhhbXBsZS5jb20iLCJpYXQiOjE3MzU2ODk2MDAsImV4cCI6MTc2NzIyNTYwMH0.fZc5SMMXQnIXN_Wp4LbRAVAIBkvKWiZcYxDJ2NzpkaAHeader
{
"alg": "HS256",
"typ": "JWT"
}
Payload
{
"sub": "1234567890",
"name": "Example User",
"iss": "https://login.example.com",
"iat": 1735689600,
"exp": 1767225600
}
ALGORITHM
HS256
EXPIRES
2026-01-01 00:00:00 UTC
STATUS
EXPIREDThe header shows alg HS256 and typ JWT, the payload shows sub, name, iss, iat and exp, and Status reads EXPIRED because exp (2026-01-01 00:00:00 UTC) has passed.
FAQ
Does it verify the token's signature?
No. It only Base64url-decodes the header and payload and ignores the signature, so a forged or altered token decodes the same way. The status line says whether exp has passed and always notes that the signature was not verified.
Which tokens can it read?
Signed JWTs with three dot-separated parts. Encrypted tokens (JWE, five parts) are rejected, nbf and iat are shown but not checked, and a part that is not valid JSON is displayed as raw text.
Is the token sent anywhere?
No. Decoding runs in your browser and nothing is uploaded. A live token can still grant access to an account, so do not paste production tokens into tools you do not trust, and revoke any token you think was phished.