QA tool

Free JWT Decoder for QA & API Testing

Paste an access token from a test environment and immediately see claims, expiry, and whether it is already stale.

JWT decoder

Live decode plus expiry timeline. Optional HS256 verify stays in the browser — secrets are not put in share links.

HS256 secret (optional)

alg HS256exp in 1289d · 3/17/2030, 5:46:40 PMiat 1025d ago

HEADER
{
  "alg": "HS256",
  "typ": "JWT"
}

PAYLOAD
{
  "sub": "123",
  "name": "Ada",
  "iat": 1700000000,
  "exp": 1900000000
}

Confirm exp/nbf when a UI shows “session expired” but the API still returns 401.
Check roles, tenant, and issuer claims before filing an auth bug.
Verify HS256 only with a non-production secret; secrets are never added to share links.

Decoding happens in your browser. Optional HS256 verification stays local. Share links include the token payload state, never the signing secret.

Processing happens in the browser. See the privacy policy for cookies and ads.