What this tool does
This goes a step further than a plain decoder: paste a token and it decodes the header and payload, checks exp/nbf against the current time, flags common security issues automatically, and — if you provide the signing secret — actually verifies the HMAC signature instead of just displaying it.
What gets checked automatically
- alg: none. Flagged as critical — an unsigned token that some misconfigured verifiers accept as valid.
- Missing exp. A token with no expiration is valid forever unless something outside the token itself revokes it.
- nbf in the future. The token isn't valid yet, even if the signature checks out.
- iat in the future. Most verifiers reject a token that claims to have been issued after the current time.
- Very long lifetime. A large gap between
iatandexp(over 30 days) is flagged so you can decide if a shorter-lived token with a refresh flow would be safer.
Why does verification need a secret?
A signature only proves something when checked against the key that produced it — there's no way to know if a token is genuine by looking at it alone. This tool verifies HMAC algorithms (HS256, HS384, HS512) because those use a single shared secret you can type in. Asymmetric algorithms (RS256, ES256, and similar) sign with a private key and verify with a public key; verifying those correctly needs the issuer's public key or JWKS endpoint, which is outside the scope of a paste-a-token browser tool.
FAQ
Is my token or secret sent anywhere?
No — decoding and signature verification both happen entirely in your browser using the Web Crypto API. Nothing is uploaded.
I just want to read the claims, no verification
Leave the secret field empty, or use the plain JWT Decoder if you don't need the automated security checks.
I need to create a token, not inspect one
Head over to the JWT Generator to build and sign a new token from a custom header and payload.