How to use it
- Paste a three-segment compact JWT.
- Inspect its header, payload and temporal claims.
- Add a secret or public key to verify the signature independently.
Runs locally in your browser
JWT decoder and signature verifier
Decode JWT header and payload, verify HS, RS, PS and ES signatures, inspect token lifetime and create HMAC JWTs locally in your browser.
…
Verify the token, not just its contents
Base64URL decoding does not prove JWT authenticity. Signature status is shown separately from token lifetime, and an unverified token is never presented as valid.
Secrets and keys stay in the memory of this page. Generate HS256, HS384 and HS512 tokens, or verify asymmetric signatures with a public key.
- Header, payload and claims
- HS/RS/PS/ES verification
- exp, nbf and iat checks
- Secrets are never persisted
Frequently asked questions
Is it safe to paste a production JWT?+
The token is decoded locally and is not sent to the application server. However, JWTs often contain personal data and act as credentials: do not share them and clear the fields when finished.
Why can I read the payload without a secret?+
A signed JWT encodes but does not encrypt its header and payload. The secret verifies integrity; it is not needed to read the contents.
Can an expired token have a valid signature?+
Yes. Signature integrity and expiration are independent checks. A valid signature does not make an expired token acceptable.