← All developer tools

JWT Decoder

Decode JWT

Paste a token to see header, payload, and claim times. Optionally verify an HMAC secret — locally.

Runs in your browser. Inputs stay on this device — nothing is uploaded to BrowserSpaces for processing.

Live decode

Header and payload as you paste.

Claims

exp / iat / nbf as human times.

HMAC verify

HS256, HS384, HS512 via WebCrypto.

Private

Token and secret never leave the tab.

Use the tool

Claim times (exp / iat / nbf) are treated as Unix seconds.

Header

—

Payload

—

How it works

Base64URL + WebCrypto

Segments decode with Base64URL. Signature checks use SubtleCrypto HMAC for supported algorithms.

Three steps

  1. 1

    Paste JWT

    Three dot-separated segments.

  2. 2

    Inspect

    Read claims and expiry status.

  3. 3

    Verify

    Optional HMAC secret.