JWT Decoder & HMAC Signature Verifier

What is a JSON Web Token?

A JSON Web Token (RFC 7519) is a compact, URL-safe means of transferring claims between two parties. Tokens consist of three Base64URL-encoded parts separated by dots: header, payload, and cryptographic signature.

Decoding extracts the header and claims into readable JSON. Verification recalculates the HMAC signature using a shared secret and validates exp (expiration), iat (issued-at), and nbf (not-before) timestamps. Work executes locally in Web Crypto; secrets and tokens are never transmitted.

Decode and verify JWT in code

JavaScript (Node.js)

const crypto = require("crypto");
const [header, payload, signature] = token.split(".");
const expected = crypto.createHmac("sha256", secret)
  .update(`${header}.${payload}`)
  .digest("base64url");
const isValid = crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

Python

import hmac, hashlib, base64
header, payload, sig = token.split(".")
expected = base64.urlsafe_b64encode(
    hmac.new(secret.encode(), f"{header}.{payload}".encode(), hashlib.sha256).digest()
).decode().rstrip("=")
is_valid = hmac.compare_digest(sig, expected)