JWT Decoder
Paste a JSON Web Token to see its decoded header and payload, check its expiry, and optionally verify an HMAC signature if you have the secret.
Nothing you paste here is sent anywhere — decoding and verification both happen locally in your browser. Only HMAC (HS256/HS384/HS512) signatures can be verified; RSA/EC-signed tokens (RS256, ES256, etc.) are decoded but not verified.