JWT Debugger & Secret Verifier
Decode JSON Web Tokens and verify HMAC signatures offline without sharing secrets. Fast, free, and fully client-side.
Encoded JWT String
Paste any JWT token string (Header.Payload.Signature).
HMAC Secret Verifier
Alg: HS256Compute and verify the HMAC signature locally in your browser memory without transmitting secrets.
Claims Analysis
Expiration (exp)
1/15/2027, 8:00:00 AM
Valid / Active (in 118d 6h)
Issued At (iat)
8/12/2025, 9:46:40 AM
402d 15h ago
Issuer (iss)
whatevertool.com
Subject (sub)
usr_1234567890
Header (JOSE Header)
{
"alg": "HS256",
"typ": "JWT",
"kid": "simple-key-1"
}Payload (Claims)
{
"sub": "usr_1234567890",
"name": "Alice Smith",
"admin": true,
"iat": 1754992000,
"exp": 1800000000,
"iss": "whatevertool.com",
"aud": [
"api.whatevertool.com"
]
}How the JWT Debugger & Secret Verifier Works
A private, offline tool for inspecting JSON Web Tokens (JWT). It decodes Header and Payload JSON structures, calculates expiry timestamps, and checks HMAC-SHA256 / SHA512 signatures using your secret key right in your browser.
Usage Example
Decode a Bearer token to check claims, roles, and expiration dates.
Frequently Asked Questions
Is it safe to paste production JWTs here?
Yes. Unlike other cloud tools, this runs 100% offline in your browser with no network requests.