Developer tools
Paste a JWT to see its header and claims, check whether it has expired, and optionally verify an HMAC signature with your secret.
Header
Payload
Paste the token (the three dot-separated parts).
Read the decoded header and payload; dates such as exp and iat are shown in your time zone.
To check the signature of an HS256/384/512 token, enter the secret.
The token is decoded in your browser and never sent anywhere. Still, treat production tokens like passwords and prefer expired or test tokens.
Yes. The header and payload are only Base64URL-encoded, not encrypted. The signature only proves the token was not changed, so never put secrets in the payload.
Last updated: 7 November 2026. See the update log at the end."Which is faster, PostgreSQL or...
Last updated: 8 November 2026. See the update log at the end.Laravel gives you safe defaults...
Last updated: 5 November 2026. See the update log at the end.In a normal PHP-FPM request,...
We use cookies to improve your experience and analyze traffic. By continuing, you agree to our Privacy Policy.
