JWT Decoder

Paste a JSON Web Token to inspect header, payload, and signature. HMAC verification is local — your secret never leaves the page.

JWT

Header

—

Payload

—

Signature

—

Verify HMAC signature

Not verified

RS256/ES256 etc. require a public key — they aren't supported here, but the structure parsing above still works for any JWT.