JWT Token
Paste a JWT
HMAC secret (optional, for HS256/384/512)
Verification happens entirely in your browser using the Web Crypto API — the secret is never sent anywhere.
A JWT is not encrypted.
Its header and payload are just Base64URL — anyone who has the token can read every claim inside it, verified or not. Never put a secret or password in a JWT payload.
Decoded
Claims
Header JSON
Payload JSON