JWT Decoder & Verifier

Decode, explain and verify JWTs. Expiry at a glance, signatures checked locally.

Runs locally · nothing uploaded
Encoded token
Header 
Payload


Claims
Signature 



Secrets and keys are only used in this tab and are never saved or sent anywhere.
What it does
Paste a token and it is decoded as you type:
  • Colour-coded token: header, payload and signature are highlighted, so a bad copy-paste is obvious.
  • Pretty JSON for the header and payload, each with copy and download.
  • Claims table that explains every standard claim (iss, sub, aud, exp, nbf, iat, jti, plus common OpenID Connect and Microsoft claims) and turns timestamps into UTC dates with relative times.
  • Status line: valid, expires in 12 min, expired 3 days ago or not valid yet. Dates in milliseconds instead of seconds are flagged.
  • Clear errors for malformed tokens: wrong number of parts, encrypted JWEs, invalid base64url characters (with position) and broken JSON.
Signature verification
Verification uses your browser’s WebCrypto API:
  • HS256 / HS384 / HS512 with a text or Base64 secret. Secrets shorter than the hash are flagged (RFC 7518).
  • RS256-512 and PS256-512 with an RSA key, ES256 / ES384 / ES512 with an EC key, and EdDSA (Ed25519) where the browser supports it.
  • Keys can be a PEM PUBLIC KEY, an RSA PUBLIC KEY, an X.509 CERTIFICATE, a JWK, or a whole JWK Set (the key is picked by kid).
  • A key that does not match the algorithm (for example an RSA key for ES256) is reported as such, not as a vague failure.
Create a token
The Create token tab signs a JSON payload with HS256, HS384 or HS512. It has buttons for iat and exp and generates a random secret of the right length.
Privacy
Tokens are decoded locally. Secrets and keys are never stored or sent anywhere. Only the token and the payload draft are kept in local storage, so remove production tokens with Clear when you are done.