JWT decoder and verifier

Paste a JSON Web Token, with or without "Bearer" in front: its header and payload show below as formatted JSON, and the badge says when it expires. Type the secret or paste the public key to check its signature.

Expiry at a glance

The badge on the editor shows the token's algorithm and when it expires or expired, read from its exp and nbf claims.

Header and payload

The header and payload show below the token, one after the other as JSON, with every claim exactly as written. Use as text (or Decode) puts them in the editor; Ctrl+Z brings the token back.

Check the signature

Type the secret for HS256, HS384 or HS512, or paste the public key, as PEM (-----BEGIN PUBLIC KEY-----) or as a JWK, for RS, PS, ES and EdDSA tokens. The check says whether the signature is valid. The key is kept only while the page is open, and never saved.

Private: nothing is uploaded

Formatting, checking and comparing all happen in your browser. Your documents are saved in the browser's own storage on this computer, not on a server, so they never leave your device.

With your permission, we count anonymous visits (which pages and tools are used), never what you type. See Privacy.

Questions

Does it verify the signature?

Yes, when you give it the key: the secret for HMAC tokens (HS256…), or the public key for RSA, ECDSA and EdDSA ones. Without a key it shows what the token says, not whether it is genuine.

Is my token or key sent anywhere?

No. Both stay in your browser. The key is never saved; the token, like any document, is kept in this browser while its tab is open, and closing the tab deletes it unless you save it.