OneFreePlace
TOOL #369 · JWT DECODER LAB

JWT Decoder

Decode JWT/JWS compact tokens locally, inspect every segment and claim, understand exp/nbf/iat timing, recognize encrypted JWE structure, export a structured report, and optionally verify HS256/384/512 signatures without sending the token or secret anywhere.

RFC 7519 awareJWS 3-part decodeJWE 5-part structureUnicode-safe Base64URLClaims timelineAlgorithm warningsLocal HMAC verification100% local

Encoded token

Waiting
Compact type—
Declared alg—
Encoded size—
Signature—
Time state*—
Segments—

Decoded header

Decoded payload
Claims
Compact serialization anatomy
Security + validity audit
*Time checks only compare exp/nbf/iat with this browser clock. They do not validate issuer, audience, nonce, signature, revocation, or application policy.
Structured report


Verify an HMAC-signed JWT locally
Supports only tokens whose declared algorithm is exactly HS256, HS384 or HS512. This deliberate allow-list prevents algorithm-confusion behavior.
No verification attempted.
Why verification is separate
A JWT decoder should never imply that decoded claims are trustworthy. Verification requires the receiving application's trusted key material, an explicit algorithm allow-list, and checks for issuer/audience and protocol-specific requirements. This tab verifies only HMAC integrity; it does not decide whether a token is acceptable to your application.


Decode vs verify
JWT header and payload segments are Base64URL-encoded, not encrypted. Anyone holding a signed JWT can normally read them. Signature verification is what establishes integrity/authenticity relative to a trusted key.
Algorithm allow-list
Do not blindly trust the token's alg value. A verifier should be configured with the algorithms that the application actually accepts, then ensure the token uses one of them.
Registered time claims
exp, nbf and iat are NumericDate values in seconds since the Unix epoch. Clock skew policy belongs to the receiving application.
Encrypted JWTs
A five-part compact token is JWE. This decoder can inspect its protected header and segment sizes, but it intentionally does not pretend ciphertext is a readable payload.
Sensitive data
Do not put secrets in JWT claims just because a token is signed. This tool performs decoding locally and never uploads pasted tokens or HMAC secrets.
Production validation
Production services should use maintained JWT libraries and validate signature, algorithm, issuer, audience, expiration, not-before, key rotation and protocol-specific claims according to their trust model.