Decode JWTs, inspect claims and verify HMAC locally without sending tokens or secrets.
The tool follows JWS compact serialization: base64url(header).base64url(payload).base64url(signature). This v1 decodes JWTs and verifies HMAC signatures locally for HS256, HS384 and HS512.
This tool solves a focused task. When the goal is better real-world security, it helps to complement it with a service focused on credentials, authentication or safer habits.
We only show partners that make editorial sense for security. On PT-BR pages, an English resource may appear as a fallback when no equivalent local option exists yet.
JWTs are part of broader identity, session and authorization architecture.
This fits here because it turns a point-in-time check into ongoing protection for accounts, credentials and day-to-day digital habits.
Affiliate link recommendation · About
No. Decoding only reads content. Trust depends on a valid signature and issuer/audience/time checks in the right system.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQSflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Token and secret stay in your browser. Do not share real JWTs through URLs, analytics or support channels.