Free tools

Free JWT Decoder & HS256 Verifier

Inspect token claims, expiry windows, and signature validity for API auth debugging and security reviews.

Copy-paste outputs

Win high-intent buyers from ChatGPT, Gemini, Claude, Perplexity, and AI Overviews before your competitors do.

One operating layer for monitoring, measurement, content action, and technical cleanup.

AI Visibility TrackingCompetitive RankingSentiment by ModelSource CitationsAI Overviews TrackingPrompt MonitoringAI Visibility TrackingCompetitive RankingSentiment by ModelSource CitationsAI Overviews TrackingPrompt Monitoring

Content GapsAI InsightsAdvanced AnalyticsData CopilotBlog GenerationUGC CampaignsLLM CouncilContent GapsAI InsightsAdvanced AnalyticsData CopilotBlog GenerationUGC CampaignsLLM Council

Shopping IntelligenceCrawler MonitoringGEO OptimizationMulti-Brand ManagementShopping IntelligenceCrawler MonitoringGEO OptimizationMulti-Brand Management

Tool 01

JWT Decoder & Verifier

Decode token claims, inspect exp/nbf/iat, and verify HS256 signatures locally.

JWT Decoder & Verifier

Decode JWT claims and verify HS256 signatures directly in your browser. No token is sent to a server.

JWT token

HS256 secret (optional)

Header

// JWT header will appear here

Payload

// JWT payload will appear here

How it works

JWT Decoder & Verifier: methodology and worked example

How this tool computes its result

Strips a leading "Bearer " prefix, splits the token on `.` and requires exactly 3 parts. Header and payload segments are base64url-decoded with a hand-rolled routine (swap `-`/`_` back to `+`/`/`, pad with `=`, `atob`, then `TextDecoder`) and parsed as JSON. Signature verification is HS256-only: it imports the provided secret as an HMAC-SHA256 `CryptoKey` via the Web Crypto API, signs `{header}.{payload}`, re-encodes the result as base64url, and compares it to the token's signature segment using a constant-time XOR loop (`timingSafeEqual`). `exp`/`nbf`/`iat` claims are rendered as human-readable dates by multiplying the Unix-seconds value by 1000.

Worked example

The well-known jwt.io demo token — header segment `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9`, payload `eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ`, signature `SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c` — decodes to header `{"alg":"HS256","typ":"JWT"}` and payload `{"sub":"1234567890","name":"John Doe","iat":1516239022}`, with `iat` shown as `2018-01-18T01:30:22.000Z`. Entering the secret `your-256-bit-secret` in the verify field returns "Signature is valid (HS256)".

When not to use this tool

Verification only supports HS256 — the effect handler explicitly checks `header.alg !== 'HS256'` and shows "Only HS256 verification is supported in this tool" for anything else, so RS256/ES256/PS256 tokens can be decoded (header/payload shown) but never cryptographically verified here.

Common mistakes

- Pasting an RS256- or ES256-signed token and a shared secret expecting verification to run — the tool short-circuits with an explicit unsupported-algorithm message rather than attempting (and failing) a signature check.
- Assuming the tool flags expired tokens as invalid — it only converts `exp`/`nbf`/`iat` to readable dates for manual inspection; it never compares them against the current time.
- Pasting a malformed or truncated token — anything that does not split into exactly 3 dot-separated parts throws "JWT must have exactly 3 dot-separated parts" instead of a partial decode.

Ready to dominate AI search visibility?

Track where your brand shows up in AI answers, close the content gaps that cost conversions, and stay visible across ChatGPT, Claude, Gemini, Perplexity, and Grok.

Start now

Other tools