Inspect claims, check expiry, verify HMAC signatures, and construct new tokens — all instantly, in your browser.
Supports HS256, HS384, and HS512. Uses the token currently in the Decode tab.
Edit the header and payload JSON, choose an algorithm, and sign with a secret.
Saved only on this device (browser local storage) — decode, verify, and build actions all log here. Click an entry to reload it.
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who issued the token |
sub | Subject | Who the token is about (e.g. user ID) |
aud | Audience | Who the token is intended for |
exp | Expiration | Unix timestamp after which the token is invalid |
nbf | Not Before | Unix timestamp before which the token isn't valid yet |
iat | Issued At | Unix timestamp when the token was created |
jti | JWT ID | Unique identifier for the token |
No. Decoding, verification, and signing all happen locally in your browser using the Web Crypto API. Nothing is sent to or stored on our servers.
Signature verification currently supports the HMAC family (HS256, HS384, HS512) using a shared secret. RS/ES tokens can still be decoded and inspected, but verifying them needs a public key check we don't support yet.
It reads the token'sexp,nbf, andiat claims and compares them to your current device time to show whether the token is valid, expired, or not yet active.
Yes. The Build tab lets you write a header and payload, pick an HMAC algorithm, enter a secret, and generate a signed token.
No. History is stored only in your browser's local storage on this device. You can delete individual entries or clear everything at any time.
All tools are free. If they've saved you time, consider supporting us.