Free · Inspect a token

JWT Decoder & Inspector

Read JWT headers and claims, check expiry and issued times, and optionally verify HS256 signatures in your browser.

  • Instant results
  • Private in your browser
  • No signup or limits

Read what is inside a JWT

Decoding is not the same as proving a token is trustworthy. Start with the claims, then check the signature when possible.

Token statusExpired
AlgorithmHS256
IssuerNot stated
AudienceNot stated
HeaderHow the token says it was made
{
  "alg": "HS256",
  "typ": "JWT"
}
PayloadThe claims carried by the token
{
  "sub": "1234567890",
  "name": "Maya Chen",
  "iat": 1786464000,
  "exp": 1786467600
}

Registered claims

Important times and identities

ClaimRaw valuePlain meaning
subSubject"1234567890"Subject
iatIssued at1786464000Tue, 11 Aug 2026 16:00:00 GMT
expExpires at1786467600Tue, 11 Aug 2026 17:00:00 GMT
Things to check
  • This token does not name an issuer (iss).
  • This token does not name an audience (aud).
Signature checkOptional · HS256

Bookify can check an HS256 signature with Web Crypto. The secret stays in this tab and is never saved. Do not paste a production secret on a shared device.

Three simple steps

How to use it

  1. Paste a token to decode its header and payload. No secret is needed to read them.
  2. Review expiry, issued-at time, audience, issuer, and security warnings.
  3. For HS256 tokens, open Signature check and enter the secret only if you trust this device.

Your data stays on this device

These tools run in your browser. Bookify does not upload, store, or inspect the values you enter. Close the tab and the working data is gone.