JWT Decoder & Generator

Paste your JWT token into the decoder. The tool automatically splits it into header, payload, and signature, displaying each section as formatted JSON. No secret key is needed just to decode the payload.

Yes. Enter your HMAC secret key and the tool verifies the signature locally using the CryptoJS library running in your browser. Your token and secret never leave your device.

Common JWT claims include: sub (user ID), exp (expiration timestamp), iat (issued at), iss (issuer), aud (audience), and custom application claims like roles or permissions.

Decode the token and look at the exp claim, it's a Unix timestamp. The tool automatically checks this against the current time and tells you if the token is expired, valid, or about to expire.

Generally yes, with this tool, because it runs locally in your browser. Never paste JWTs containing sensitive data into online tools that send data to their servers. This tool is safe because nothing is transmitted.

This tool uses HMAC SHA256 (HS256), the most common JWT signing algorithm. It uses a shared secret key for both signing and verification. For RS256 (asymmetric), a different tool with RSA key support is needed.

Paste the token and the tool splits it into header, payload and signature and Base64URL-decodes the first two so you can read the claims as JSON. Decoding happens in your browser, so the token never leaves your device.

Yes. The decoded payload shows the exp (expiry) and iat (issued-at) claims as readable dates, so you can immediately see whether the token is still valid.

No. Everything runs locally in your browser, which makes it safe to inspect real tokens while debugging without exposing them.

Yes. Decoding, verification, and signing all happen locally in your browser, neither the token nor your secret is sent anywhere.

Decode it and read the exp claim; the tool shows the expiry timestamp so you can compare it to the current time.