$ loading▍
$ loading▍
Paste a JSON Web Token to read its header and claims, see when it expires, and verify its signature, without the token ever leaving your browser.
Encoded token
decoded in your browser · never stored or sent
Verify signature
Paste a token to check its signature.
Header
The algorithm and token type appear here.
Payload
The claims (who, what, until when) appear here.
Pasting a real token into an online decoder can hand someone your session. This one decodes in the browser, stores nothing and has no share link.
Verify HS, RS, PS, ES and EdDSA signatures with a secret, a PEM public key or a JWK, using the browser's own Web Crypto.
exp, iat and nbf become dates with countdowns, standard claims are labeled, and risky tokens get a clear warning.
// faq
The token is decoded and verified by code running in your browser; it isn't sent anywhere, saved, or put in a share link. Still, treat live tokens like passwords: anyone holding one can act as its owner until it expires.
Usually not. A standard JWT (JWS) is only signed: the header and payload are base64url-encoded JSON that anyone can read. The signature proves who issued it and that it wasn't changed. Encrypted tokens (JWE) have five parts and can't be read without the private key.
For HS256/384/512, enter the shared secret the server signs with. For RS, PS, ES and EdDSA tokens, paste the issuer's public key as PEM (-----BEGIN PUBLIC KEY-----) or as a JWK; identity providers publish these at a JWKS URL like /.well-known/jwks.json.
The key doesn't match the one that signed the token, the token was edited, or, for HMAC, the secret is base64-encoded and needs the “secret is base64 encoded” switch. For JWKS, make sure you pasted the key whose kid matches the token header.
The token claims to have no signature at all. A server that accepts it would trust whatever the payload says, which is a classic vulnerability. Servers should only accept the algorithms they expect.
Looking for something bigger? The products are full apps: an encrypted password vault, self-hosted CI/CD, and more.