JWT Decoder and Verifier

What it does

Decodes a JWT's header and payload and shows the times (iat, nbf, exp) in a readable form. Optionally, it verifies the signature against a key you supply.

Decoding is not verifying

Anyone can read a JWT — it is just base64url. Seeing decoded claims tells you nothing about whether the token is authentic. This tool keeps the two separate: decode-only is clearly marked not verified, and a verified signature is described precisely — it matches the key you supplied, and the business claims (issuer, audience, nonce, your own rules) are still not checked.

Built to resist footguns

You must choose the expected algorithm explicitly; verifying an RS256 token as HS256 is a classic forgery, so the tool refuses when the header disagrees with your choice. Tokens with alg: none are rejected outright. HS256, RS256 and ES256 are supported via the Web Crypto API.

Privacy

Decoding and verification both happen in your browser with the Web Crypto API. Your token and your key are never transmitted anywhere.