JWT Debugger & Secret Verifier
Decode JSON Web Tokens and verify HMAC signatures offline without sharing secrets. Fast, free, and fully client-side.
Encoded JWT String
Paste any JWT token string (Header.Payload.Signature).
HMAC Secret Verifier
Alg: HS256Compute and verify the HMAC signature locally in your browser memory without transmitting secrets.
Claims Analysis
Expiration (exp)
1/15/2027, 8:00:00 AM
Valid / Active (in 154d 17h)
Issued At (iat)
8/12/2025, 9:46:40 AM
366d 4h ago
Issuer (iss)
whatevertool.com
Subject (sub)
usr_1234567890
Header (JOSE Header)
{
"alg": "HS256",
"typ": "JWT",
"kid": "simple-key-1"
}Payload (Claims)
{
"sub": "usr_1234567890",
"name": "Alice Smith",
"admin": true,
"iat": 1754992000,
"exp": 1800000000,
"iss": "whatevertool.com",
"aud": [
"api.whatevertool.com"
]
}How the JWT Debugger & Secret Verifier Works
A private, offline JSON Web Token (JWT) inspector. Decodes Header and Payload JSON structures, computes expiry timestamps, and verifies HMAC-SHA256 / SHA512 signatures with your secret key locally in your browser.
Usage Example
Decode an authorization bearer token to inspect claims, roles, and expiration dates.
Frequently Asked Questions
Is it safe to paste production JWTs here?
Yes. Unlike cloud-based JWT tools, this tool runs 100% offline in your browser with zero network requests.