JWT decoder and verifier that never transmits your token
Decode a JSON Web Token, read its claims in plain language, and verify the signature locally with the browser's own cryptography. A token is a bearer credential — this page is built so that it cannot leave your tab.
How to use it
- Paste the token. A leading
Bearerand stray whitespace are handled for you. - Read the header and payload. Timestamps are shown as both the raw value and a readable date, and the status at the top says whether the token is currently valid, expired, or not yet in force.
- To check the signature, paste the key and press Verify (V). For HS algorithms that is the shared secret; for RS, PS and ES it is a public key as a PEM block or a JWK.
What a JWT is made of
Three base64url segments separated by dots: header.payload.signature.
The header names the signing algorithm and often a key ID. The payload holds the
claims. The signature covers the first two segments, so changing either one
invalidates it.
The first two segments are encoded, not encrypted. Anyone holding the token can read every claim in it — which is why a JWT should never carry anything you would not hand to the person presenting it. A token with five segments is a JWE, which is encrypted and cannot be read without the key.
Registered claims
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created and signed the token. |
sub | Subject | Who the token is about, usually a user ID. |
aud | Audience | Who the token is intended for. A service should reject tokens addressed elsewhere. |
exp | Expiration time | Unix timestamp after which it must be rejected. |
nbf | Not before | Unix timestamp before which it is not yet valid. |
iat | Issued at | When it was created. With exp, this gives the lifetime. |
jti | JWT ID | Unique identifier, used to make a token single-use or revocable. |
Signature algorithms
- HS256 / HS384 / HS512 — symmetric
- One shared secret both signs and verifies. Simple, but every party that can verify a token can also mint one, so a leaked verification secret is a full impersonation of the issuer. Verified here against a secret you paste.
- RS256 / RS384 / RS512 and PS variants — RSA
- A private key signs and a public key verifies, so verifiers cannot forge tokens. Verified here against a PEM public key or a JWK.
- ES256 / ES384 / ES512 — elliptic curve
- The same asymmetric property as RSA with much smaller keys and signatures. Also verified locally.
none— no signature- A legal value in the specification and a serious hazard in practice. If a verifier accepts it, an attacker rewrites the payload, drops the signature and is believed. This decoder flags it rather than quietly showing the claims.
What gets flagged
- Expired or not yet valid — checked against
expandnbf, with how long ago or how far ahead. - No expiry at all — a token with no
expis valid until the signing key changes, which makes revocation very hard. - A very long lifetime — a bearer token good for months is an outsized prize for whoever finds it in a log.
- Symmetric signing — noted so you know who else could mint this token.
Why local verification matters
Verifying a signature needs the key. Pasting a shared secret into a page that transmits it hands over the ability to forge tokens for that issuer — a worse outcome than leaking the single token you were debugging. Here both the token and the key stay in the tab: verification uses WebCrypto in your browser, and the Content-Security-Policy blocks outbound requests entirely.
Frequently asked questions
Is it safe to paste a JWT into this page?
Safer than anywhere that uploads it. A JWT is a bearer credential — whoever holds it can act as that user until it expires. Pasting one into a tool that transmits it to a server is handing over an active session. This decoder runs entirely in your browser, and the Content-Security-Policy blocks all outbound requests.
Can I verify a signature without uploading my secret?
Yes. Signature verification runs in WebCrypto, inside your browser tab. For HS256/384/512 you paste the shared secret; for RS and ES algorithms you paste a public key or JWK. The secret or key never leaves your machine.
What is the 'none' algorithm and why does it show as a warning?
alg:none is an algorithm that requires no signature at all. It is permitted by the JWT specification for debugging, but in production it allows an attacker to modify any claim in the payload and forge a valid-looking token. This tool flags it immediately.