What does this JWT decoder show?

It decodes the JWT header and payload, shows expiry and not-before claims, and performs a local signature validity check when you provide the right key.

Does my JWT leave the browser?

No. The decoder runs locally in your browser and does not need a server to inspect or verify tokens.

Which algorithms are supported?

This version supports HS256, HS384, HS512, RS256, RS384, and RS512 tokens. HMAC tokens need a shared secret, while RSA tokens need a PEM public key.

Why would I use a JWT inspector?

Backend developers use JWT inspectors to debug auth flows, confirm token expiry, check claim contents, and verify that a token was signed with the expected key.

JWT Decoder / Inspector

JWT Decoder

Paste a JWT to inspect the header, payload, expiry, and signature status locally.

Local-only verification for HS* and RS*/PS* tokens.

AlgorithmHS256

Expiry6/1/2026, 4:03:51 PM

Signatureidle

Segments3

Input

JWT

Signature check key

Paste the shared secret for HS* tokens.

Decoded

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Decoded

Payload

{
  "sub": "devora-demo",
  "name": "Devora",
  "role": "backend-dev",
  "iss": "devoratools.com",
  "aud": "jwt-inspector",
  "iat": 1780325931,
  "exp": 1780329831
}

Claims

Quick readout

SUBdevora-demo

ISSdevoratools.com

AUDjwt-inspector

IAT6/1/2026, 2:58:51 PM

EXP6/1/2026, 4:03:51 PM