JWT Decoder & Verifier
Paste a JWT to read its header and payload, check whether it has expired, and verify the signature with a secret or a public key.
Runs in your browser — nothing is uploaded.
Header
CopiedPayload
CopiedTime claims
| Claim | Date | Status |
|---|---|---|
Signature
Verify signature
HS: the secret. RS / PS / ES: a PEM public key or a JWK / JWKS.
How to use it
- Paste the token (a leading “Bearer ” is ignored). The header, payload and dates appear straight away.
- To verify the signature, enter the secret (HS256/384/512) or the public key as PEM or JWK (RS, PS and ES algorithms) and press Verify.
- Heed the warnings: a token with alg “none” has no signature and proves nothing.
Frequently asked questions
Is my token or key uploaded?
No. Decoding and verification run in your browser with the Web Crypto API. This page loads no ads, analytics or third-party scripts, and nothing you paste is logged.
Which algorithms can it verify?
HS256, HS384, HS512 (secret), RS256/384/512 and PS256/384/512 (RSA public key) and ES256/384/512 (P-256, P-384, P-521 public key).
Which key formats are accepted?
A PEM public key (“BEGIN PUBLIC KEY” or “BEGIN RSA PUBLIC KEY”), a single JWK, or a JWKS (the key whose kid matches the token is used, otherwise the first). For HS tokens, the secret as text, as base64url, or as an oct JWK.
Does a decoded token mean it is valid?
No. Anyone can read a JWT; only a successful signature check shows it was issued by the holder of the key. Servers must also check exp, aud and iss.
Why the alg “none” warning?
A token with alg “none” is unsigned. Servers that accept it let anyone forge tokens, so this tool refuses to “verify” it.