JWT Header Algorithm Inspector

Read the JWT header section to identify the signing algorithm (HS256, RS256, ES256) and token type — essential for debugging signature verification failures.

AUTH DEBUG

JWT Decoder

> Decode JWT header and payload locally in your browser.
> Inspect exp, iat, and nbf claims without sending bearer tokens to third-party sites.

JWT or Bearer token

Decode only

This tool decodes header and payload locally. It does not verify the signature or prove the token is trustworthy.

Header JSON

// Decoded JSON appears here...

Payload JSON

// Decoded JSON appears here...

Claim timing

Header, payload, signature segment state, and timestamp analysis will appear here.

Signature segment

// Signature segment appears here...

What this tool can and cannot tell you

Can decode header/payload structure locally.
Can show readable timestamps for exp, iat, and nbf.
Cannot verify the cryptographic signature.
Cannot prove the token was issued by the expected system.

Understanding the JWT Header Section

The first segment of a JWT is the header, a base64url-encoded JSON object that describes how the token is signed. The most important field is alg, which specifies the signing algorithm: HS256 (HMAC-SHA256, symmetric), RS256 (RSA-SHA256, asymmetric with public/private keys), or ES256 (ECDSA, used by modern OAuth providers). The typ field is almost always JWT. Understanding the header algorithm is critical when you encounter signature verification errors — matching the algorithm in your backend code to the one declared in the header resolves the majority of JWT authentication bugs.

FAQ

What is the difference between HS256 and RS256 in JWT?

HS256 is a symmetric algorithm using a single shared secret. RS256 is asymmetric, using a private key to sign and a public key to verify — making it safer for distributed systems since only the public key needs to be shared.

You May Also Need

Base64

Encode and decode text to/from Base64 format with UTF-8 support.

URL Encoder

Encode and decode URL components or form values with UTF-8-safe browser processing.

JSON Formatter

Validation, formatting and syntax highlighting for JSON.

Password Generator

Cryptographically secure password generator.

View all tools in this category →

Claim timing

Header, payload, signature segment state, and timestamp analysis will appear here.

Signature segment

// Signature segment appears here...

What this tool can and cannot tell you

Can decode header/payload structure locally.
Can show readable timestamps for exp, iat, and nbf.
Cannot verify the cryptographic signature.
Cannot prove the token was issued by the expected system.

Understanding the JWT Header Section