JWT decoder and verifier that never transmits your token
Decode a JSON Web Token, read its claims in plain language, and verify the signature locally with the browser's own cryptography. A token is a bearer credential — this page is built so that it cannot leave your tab.
How to use it
- Paste the token. A leading
Bearerand stray whitespace are handled for you. - Read the header and payload. Timestamps are shown as both the raw value and a readable date, and the status at the top says whether the token is currently valid, expired, or not yet in force.
- To check the signature, paste the key and press Verify (V). For HS algorithms that is the shared secret; for RS, PS and ES it is a public key as a PEM block or a JWK.
What a JWT is made of
Three base64url segments separated by dots: header.payload.signature.
The header names the signing algorithm and often a key ID. The payload holds the
claims. The signature covers the first two segments, so changing either one
invalidates it.
The first two segments are encoded, not encrypted. Anyone holding the token can read every claim in it — which is why a JWT should never carry anything you would not hand to the person presenting it. A token with five segments is a JWE, which is encrypted and cannot be read without the key.
Registered claims
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created and signed the token. |
sub | Subject | Who the token is about, usually a user ID. |
aud | Audience | Who the token is intended for. A service should reject tokens addressed elsewhere. |
exp | Expiration time | Unix timestamp after which it must be rejected. |
nbf | Not before | Unix timestamp before which it is not yet valid. |
iat | Issued at | When it was created. With exp, this gives the lifetime. |
jti | JWT ID | Unique identifier, used to make a token single-use or revocable. |
Signature algorithms
- HS256 / HS384 / HS512 — symmetric
- One shared secret both signs and verifies. Simple, but every party that can verify a token can also mint one, so a leaked verification secret is a full impersonation of the issuer. Verified here against a secret you paste.
- RS256 / RS384 / RS512 and PS variants — RSA
- A private key signs and a public key verifies, so verifiers cannot forge tokens. Verified here against a PEM public key or a JWK.
- ES256 / ES384 / ES512 — elliptic curve
- The same asymmetric property as RSA with much smaller keys and signatures. Also verified locally.
none— no signature- A legal value in the specification and a serious hazard in practice. If a verifier accepts it, an attacker rewrites the payload, drops the signature and is believed. This decoder flags it rather than quietly showing the claims.
What gets flagged
- Expired or not yet valid — checked against
expandnbf, with how long ago or how far ahead. - No expiry at all — a token with no
expis valid until the signing key changes, which makes revocation very hard. - A very long lifetime — a bearer token good for months is an outsized prize for whoever finds it in a log.
- Symmetric signing — noted so you know who else could mint this token.
Why local verification matters
Verifying a signature needs the key. Pasting a shared secret into a page that transmits it hands over the ability to forge tokens for that issuer — a worse outcome than leaking the single token you were debugging. Here both the token and the key stay in the tab: verification uses WebCrypto in your browser, and the Content-Security-Policy blocks outbound requests entirely.
Frequently asked questions
Is it safe to paste a JWT into this page?
A JWT is a bearer credential: whoever holds it can act as you until it expires. Pasting one into a site that transmits it is handing over an account. This decoder runs entirely in your browser and the Content-Security-Policy blocks every outbound request, so the token cannot leave the tab.
Can it verify the signature, not just decode it?
Yes, locally, using the browser's built-in WebCrypto. HS256, HS384 and HS512 verify against a shared secret. RS, PS and ES algorithms verify against a public key pasted as a PEM block or a JWK. The key never leaves the tab either.
What does alg: none mean?
It means the token carries no signature at all. Any verifier that accepts alg: none can be trivially forged against — an attacker rewrites the payload, strips the signature and is believed. It should never be accepted in production, and this decoder flags it.
Why warn about HS256 when it is a valid algorithm?
Because it is symmetric: the same secret both signs and verifies. Anyone who can verify your tokens can also mint them, so every service holding the verification secret can impersonate your issuer. Asymmetric algorithms such as RS256 and ES256 avoid that by giving verifiers only a public key.
What do exp, iat and nbf mean?
They are Unix timestamps. exp is when the token expires, iat when it was issued, and nbf the earliest moment it is valid. This decoder shows each as an ISO timestamp and in plain language, and tells you up front whether the token is currently within its window.
The decoder says my token has three parts but will not decode. Why?
Usually the payload is not JSON, which happens with nested or encrypted tokens. A JWE — an encrypted token — has five dot-separated parts and cannot be read at all without the decryption key. A truncated copy-paste is the other common cause.