HS384 JWT Decoder & Verifier
Paste an HS384-signed JWT to decode its header and payload. Enter the shared HMAC secret to verify the signature — all processing happens locally in your browser.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
What is HS384 in a JWT?
HS384 is HMAC using SHA-384, the middle member of the HMAC-SHA-2 JWT algorithm family (HS256, HS384, HS512). Like HS256, it is a symmetric algorithm — the same secret is used to sign and verify. The key difference is the hash function: SHA-384 produces a 384-bit digest and offers a 192-bit security level, compared to 128 bits for HS256.
HS384 is less common than HS256 in practice. Most applications do not need the additional security headroom of SHA-384 for their JWT use cases — HS256 is generally sufficient. HS384 is a reasonable choice when compliance requirements or internal policies mandate a higher security level without switching to an asymmetric algorithm.
To verify an HS384 JWT above, paste your token, go to the Signature tab, select HS384, and enter your shared secret. The tool uses the Web Crypto API's HMAC-SHA-384 implementation to verify locally — nothing is transmitted to a server.
HS384 at a glance
- Full name
- HMAC using SHA-384
- Algorithm family
- HMAC (symmetric)
- Key type
- Shared secret (≥ 384 bits recommended)
- Signature size
- 384 bits (48 bytes)
- Security level
- 192 bits
- Verification key
- Same secret as signing key
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.