Decode and inspect JWT tokens — view header, payload, expiration, issuer, subject, and other standard claims. Paste an HMAC secret to genuinely verify HS256/384/512 signatures — local inspection, free, no signup.
Content reviewed October 2026 · About Toolzum
Decode Base64 strings and pretty-print JSON data — paste encoded text to see the decoded result instantly. Inspect API payloads and tokens readably — free, local, no signup.
Decode JWT headers and payloads instantly — inspect claims, expiry, and algorithm before trusting a token. Debug auth failures in seconds — local processing, free, no signup.
Build and sign JWTs with HS256/RS256 — headers, claims, expiry, and signature verification. Mint test tokens without backend roundtrips — local crypto, free, no signup.
Inspect any character's Unicode code points, HTML entities, and percent-encoded bytes. Debug invisible text issues precisely — local inspection, free, no signup.
Scan and clear cookies, localStorage, and sessionStorage for the current site — see what's stored first. Audit privacy trackers before wiping — local inspection, free, no signup.
Header (algorithm, type), payload (all claims), and signature. Standard claims like exp, iss, sub, aud, iat, and jti are decoded and displayed with human-readable labels.
Yes for HMAC: paste the signing secret and HS256/384/512 signatures are recomputed via WebCrypto and compared — match or mismatch reported. RS/ES need public keys this tool doesn't collect, so those stay unverified, never valid.
Yes. The 'exp' claim is decoded to a human-readable timestamp, and the tool shows whether the token is currently valid or expired.
It decodes headers for any algorithm (HS256, RS256, ES256, etc.). However, it only displays the content — it does not perform signature verification for any algorithm.
No. All decoding happens locally in your browser. No JWT data is sent to any server.
HMAC signing only: HS256 maps to SHA-256, HS384 to SHA-384 and HS512 to SHA-512 via Web Crypto. An empty secret blocks with Enter a secret to sign with, non-object JSON blocks, and the selected algorithm overwrites any alg in your header JSON. Encoding works in 0x8000-character chunks.
JWT Inspector
Decode JWT headers and payloads instantly — inspect claims, expiry, and algorithm before trusting a token. Debug auth failures in seconds — local processing, free, no signup.
JWT Encoder & Signer
Build and sign JWTs with HS256/RS256 — headers, claims, expiry, and signature verification. Mint test tokens without backend roundtrips — local crypto, free, no signup.