Decode a JWT and check its signature
Paste a JSON Web Token to read its header and payload, see when it expires and check its signature.
- Runs on your device
- No sign-up
- Works offline after a visit
The token and keys stay in this tab. Nothing is stored.
Header
Payload
| Claim | Value | What it means |
|---|
Signature
Security notes
How to decode a JWT and check its signature
- Paste the token, or try the example.
- Type the secret, or paste the public key, to check the signature.
- Read the verdict, the claims and the security notes.
Questions
Is my token sent anywhere?
No. Decoding and signature checks run in your browser with Web Crypto. The token and keys are not stored or sent to a server.
Why does it say the signature is not checked?
Checking needs the secret for HS256, HS384 or HS512, or the public key for RS, PS, ES and EdDSA tokens. Reading the payload does not prove who signed it. The example token is signed with the secret your-256-bit-secret.
Can it open an encrypted token?
No. An encrypted token (JWE, five parts) needs the decryption key, which this tool does not take, so it says so and stops there.
Which key formats work?
A PEM public key that starts with BEGIN PUBLIC KEY, or a JWK in JSON. Certificates (BEGIN CERTIFICATE) and PKCS#1 keys are not read here. EdDSA needs a browser that supports Ed25519.
Reviews
No reviews yet. Be the first.