Skip to tool content
Toolioz logoToolioz
Auth & Token Debugger

JWT Decoder

A JWT has three base64url parts. Header and payload are decoded with atob. crypto.subtle.verify checks HS256 only when a secret is typed. (Not expired) compares exp with the current time and is not a signature result.

Encoded Token

Verify Signature

Unverified
HS256 checks use the Web Crypto API in this tab. The secret is not uploaded.

Header ALGORITHM AND TYPE

Waiting for token...

Payload CLAIMS

Waiting for token...

What is JWT signature verification?

Signature verification checks that a JWT payload still matches the HS256 signature produced with a shared secret. Decoding the header and payload does not prove the token is authentic.

How are JWT expiration claims read?

The exp, iat, and nbf claims are Unix times in seconds. This page shows them with toLocaleString(), which is the browser's local time. (Not expired) means exp is not earlier than now. It does not mean the signature was checked. nbf is displayed and is not compared with the current time.

Frequently Asked Questions

A JWT has three dot-separated base64url parts: the header names the algorithm, the payload holds the claims, and the signature covers the first two parts.

On this page, decoding runs in the browser. The token and any typed HS256 secret are not uploaded. Decoding still does not prove the signature is valid.

HS256 uses one shared secret to sign and to check a token. RS256 uses a private key to sign and a public key to check. This page can check HS256 only.

Publisher notes · reviewed 10 September 2026

Decoding a JWT is not verifying it

A JSON Web Token is three Base64URL parts. This page decodes the header and payload with atob. crypto.subtle.verify checks an HS256 signature only when a secret is typed and alg is HS256. (Not expired) means exp is not earlier than now. nbf is shown in local time and is not compared. There is no JWKS fetch and no RS256 check.

How to use the output safely

Read `alg`, `iss`, `aud`, `exp`, and `sub` as claims, not as proof, unless an HS256 check with the correct secret succeeds. If `alg` is `none`, the token has no signature. If `exp` is in the past, resource servers should reject it. Toolioz does not contact the issuer. Never paste a live access token from a production user into a public blog screenshot.

HS256 needs a shared secret you should not type into a random website if your policy forbids it. RS256 needs the issuer public key; this page does not fetch JWKS. Use your auth library in a trusted environment for production verification.

Worked examples

  • Expiry check

    An `exp` of 1735689600 is a Unix second timestamp. Convert it with any Unix-time converter. If it is in the past, treat the token as expired regardless of a pretty-printed payload.

Limits of this page

  • No JWKS fetch, no audience check, no encrypted JWE support as a full decryptor unless the page explicitly says so.

Sources