CheatSheetsCheatSheets
🔒 Privacy Safe:All processing is done 100% locally in your browser, nothing is uploaded to the server.

JWT Decoder

Decode JWT locally, verify expiry and signature (optional secret).

  • Local decode, no upload
  • Auto expiry detection
  • HS256 verify
  • Pretty Header/Payload

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1916239022
}
Expires at: 9/22/2030, 12:37:02 AM
Not expired

How to use JWT Decoder

  1. Paste Token：Paste the full JWT into the input
  2. Inspect payload：Header/Payload and expiry auto-parse
  3. Verify signature：Optionally enter a secret to verify HS256

FAQ

Will my Token be uploaded?
No, decoding and expiry checks are fully local; even HMAC verification with your secret never leaves the browser.
How do I know if a Token expired?
exp/iat/nbf are auto-parsed into local time with expired/remaining status at a glance.
Which signature algorithms are supported?
HS256/HS384/HS512 verify with your secret; RS256 and other asymmetric algorithms decode for display only.