Guide

How to Decode and Inspect a JWT Before You Trust It

Decode a JWT, inspect claims and expiry, and verify HS256/384/512 locally without sending secrets to a server.

By Haivix Team 9 min read
Abstract three-segment token blocks suggesting a JWT on a dark navy background

A JWT is three Base64url segments: header, payload, and signature. Decoding shows what the token claims. It does not prove the issuer signed it—only verification with the correct key does that.

Haivix JWT Studio decodes compact JWTs in the browser, shows algorithm and timing state, lists registered claims, and can sign or verify with Web Crypto HMAC (HS256, HS384, HS512). The token and secret stay in your tab.

Decode vs verify

Paste a header.payload.signature string to see the JSON header and payload. You can edit those JSON panels for local experiments. Summary fields include algorithm, timing state, and signature status.

Registered claims UI covers iss, sub, aud, jti, iat, nbf, and exp, with NumericDate values shown as ISO times. Timing states use the device clock: active, expired, not active yet, or no exp/nbf. There is no clock-skew window.

HMAC sign and verify only

Sign and verify use shared-secret HMAC algorithms only. RSA, ECDSA, PSS, JWKS, and kid resolution are out of scope. Non-HMAC tokens can still be decoded and inspected; they cannot be signed or verified here.

Show/hide secret, copy token, load a signed local example, and clear are available. Treat any secret you paste as sensitive—clipboard history on the device may retain it.

Pair with API and JSON tools

When a bearer token comes from an HTTP response, capture the call in API Request Studio, then paste the JWT here. Pretty-print claim JSON with the JSON Formatter if you export the payload. Unix seconds in claims can be cross-checked with the Timestamp Converter.

Checklist before you trust a token

Open JWT Studio, paste the token, inspect claims, and verify HS256/384/512 when you have the shared secret. Haivix does not store the token.

  • You verified the signature with the real secret—not decode alone.
  • Algorithm matches what your server expects (watch for alg confusion).
  • exp and nbf make sense on a trusted clock.
  • iss, aud, and sub match the API you are calling.
  • Asymmetric production tokens were verified with the issuer’s keys elsewhere.
  • Secrets were not pasted into chat logs or shared screenshots.