How to use it
Paste a JSON Web Token and this tool decodes its header and payload from base64url so you can read the claims. Time fields like exp, iat and nbf are shown as readable dates. It can also verify the signature locally with your HMAC secret or public key (PEM/JWK) — RSA, ECDSA and EdDSA included — using the Web Crypto API, so the key never leaves your device. As a precaution, prefer a test secret over a production one in any web tool.
Example
eyJhbGciOiJIUzI1Ni….<payload>.<signature> header: alg=HS256, typ=JWT — payload: sub, name, iat The signature is shown but NOT verified.
Frequently asked questions
Does it verify the signature?
Yes, locally. Paste the HMAC secret or the public key (PEM or JWK) and the tool verifies the signature in your browser via the Web Crypto API — the key never leaves your device. It supports HS256/384/512, RS/PS, ES256/384/512 and EdDSA, rejects alg:none, and blocks RSA→HMAC algorithm-confusion. Tip: avoid pasting a production HMAC secret into any web tool; use a test secret.
Is my token sent anywhere?
No. Decoding happens entirely in your browser; the token never leaves your device. That matters because a JWT often carries sensitive data.
What are exp, iat and nbf?
Standard time claims: exp (expires), iat (issued at) and nbf (not before), in Unix seconds. The tool shows them as readable UTC dates.