HS256 JWT Decoder & Verifier
Paste an HS256-signed JWT to decode its header and payload. Enter the shared HMAC secret to verify the signature — verification runs locally in your browser, your secret is never sent anywhere.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
What is HS256 in a JWT?
HS256 stands for HMAC using SHA-256. It is a symmetric signing algorithm, meaning the same secret key is used both to sign the JWT and to verify it. The signer (usually your auth server) hashes the encoded header and payload with the secret using HMAC-SHA256 and includes the result as the signature. The verifier (your API) applies the same HMAC operation and compares the output — if they match, the token is authentic.
HS256 is the default algorithm in many JWT libraries and is appropriate when the signing party and the verifying party are the same service or when they can share a secret securely. It is fast, requires no key pair management, and produces a compact 256-bit signature. The main risk is that any party holding the secret can also forge tokens — if you need to give verifiers access without allowing them to create tokens, use RS256 instead.
To verify an HS256 JWT above, paste your token in the decoder, switch to the Signature tab, select HS256, and enter the base64-encoded or UTF-8 shared secret. Verification happens locally using the Web Crypto API — the secret never leaves your browser.
HS256 at a glance
- Full name
- HMAC using SHA-256
- Algorithm family
- HMAC (symmetric)
- Key type
- Shared secret (any length, ≥ 256 bits recommended)
- Signature size
- 256 bits (32 bytes)
- Security level
- 128 bits
- Verification key
- Same secret as signing key
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.