JWT Decoder
Decode and inspect JSON Web Tokens. Runs in your browser — nothing sent anywhere.
About JSON Web Tokens
What are the three parts of a JWT?
Header — algorithm and token type (e.g.
{"alg":"HS256","typ":"JWT"}). Payload — claims about the user or session. Signature — a cryptographic hash of the header and payload, signed with a secret or private key. Only the first two are decoded here.What's the difference between JWT and HMAC webhook signatures?
JWTs are self-contained tokens typically used for authentication — the claims are inside the token itself. HMAC webhook signatures (used by Stripe, GitHub, etc.) are separate from the payload: a header like
X-Hub-Signature-256 contains a hash of the request body. Use the HMAC tool to verify those.Can this tool verify a JWT signature?
No. Signature verification requires the secret key or public key used to sign the token. This tool decodes and displays the contents. Always verify signatures server-side with a proper JWT library before trusting any claims.
What does exp mean in a JWT payload?
exp is the expiration time — a Unix timestamp (seconds since 1970-01-01). This tool automatically converts it to a human-readable date and shows whether the token is expired. iat is the issued-at time, nbf is not-before.Inspecting webhook payloads manually?
HookDeploy captures every webhook, stores it with full history, and lets you inspect, replay, and route it — without writing any code.