JWT Header Decoder

InputCopy

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0
.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Output

Algorithm
alg     : HS256
family  : HMAC
hash    : SHA-256
min key : 256 bits
grade   : B  ████░ Good
HMAC with SHA-256. Symmetric — both parties share the same secret.
Recommendation:
  Ensure the secret is at least 32 bytes of cryptographically random data.
  Rotate secrets regularly.
  Avoid if the verifier is untrusted (symmetric = anyone who verifies can also forge)..

Token type
typ         : JWT
encrypted   : no (JWS)
nested      : no
compressed  : no
has key hint: no

Key guidance
Key format : Raw bytes (256-bit minimum)
Key store  : Environment variable or secrets manager — never in source code
Verify with: The same HMAC secret used to sign
JWKS       : Not applicable — HMAC is symmetric, public keys cannot be published

Header fields
alg         : "HS256"
  RFC 7515 §4.1.1 [security-relevant]
  Cryptographic algorithm used to sign or encrypt the token
typ         : "JWT"
  RFC 7519 §5.1
  Token type — 'JWT' for standard tokens, 'at+JWT' for OAuth access tokens

Raw header
{
  "alg": "HS256",
  "typ": "JWT"
}