Loading
Compiling your experience... ⚡
A free, private JWT decoder and verifier — header/payload/signature viewer, claims analysis, and HMAC signature verification, entirely in your browser.
Initializing JWT Studio...
Paste any JSON Web Token to see its decoded header and payload, analyzed claims with human-readable timestamps and warnings, and optionally verify its HMAC signature against a secret you supply — entirely in your browser via the Web Crypto API.
Paste any JWT, or click "Load Example" to see a real, correctly-signed example token.
See the decoded header and payload as formatted JSON, plus a claims table with human-readable expiration/issued-at/not-before analysis and warnings for expired or unusual tokens.
Choose the algorithm you expect (HS256/384/512) and enter the secret key to check whether the signature is valid — this never trusts the token’s own declared algorithm.
Everything you need to know about this developer tool
No. Decoding and verification both run entirely inside your browser using the Web Crypto API. Your token is never sent anywhere.
No. Decoding only reveals the header and payload — it does not verify the signature. A token can be decoded and read even if it has been tampered with or was never signed at all.
Not yet — this baseline supports HMAC-signed tokens (HS256/384/512) only. Asymmetric algorithm support is a planned follow-on, since it requires careful PEM/JWK key-format parsing to do correctly.
Scan and score resumes against Job Descriptions using AI analysis.
Visualize JS call stack, microtasks queue, macrotasks queue, and Web APIs in real time.
Step through React Fiber trees, state queues, reconciliation loops, and concurrent preemption.