/tools/jwt-decoder
JWT Decoder & Signature Verifier
Paste a JWT, API response, or bearer header. The tool finds the token, explains its claims, and can verify its signature.
Paste a JWT or API response
Direct compact tokens, JSON fields, nested payloads, and bearer headers are recognised.
Credential safety: live tokens and HMAC secrets are sensitive. Processing stays in this browser.
Inspect the decoded token
Payload first, with header details and claim timing close at hand.
- Algorithm
- —
- Type
- —
- Signature
- —
- Claim timing
- Not assessed
Decoded JSON
Registered claims
Application checks remain separateVerify the signature Optional · use a trusted key you already have Not verified
Verification uses the exact algorithm declared by the token. No key discovery or remote JWKS requests are made.
Provide the signing key and run verification.
A valid signature proves that the token matches this key. Your application must still trust the key and validate iss, aud, permissions, and other claims.
/decode-and-verify
How to decode and verify a JWT
- Paste a compact JWT, JSON API response, or bearer header. The tool locates valid JWT candidates and prioritises common fields such as
access_token,id_token, andtoken. - If several JWTs are present, choose the intended candidate from the detected-token list.
- Review the algorithm and registered claims. Expiry and not-before checks include the chosen clock tolerance.
- For HS algorithms, enter the shared secret. For RS, PS, or ES algorithms, paste an SPKI public key, JWK, or JWKS.
- Choose Verify signature. Verification uses the exact algorithm declared by the token and runs locally with Web Crypto.
/algorithm-support
Supported JWT signature algorithms
HMAC and RSA
Verify HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, and PS512 signatures. HMAC secrets can be entered as UTF-8 or Base64URL bytes.
Elliptic curve
Verify ES256, ES384, and ES512 with P-256, P-384, and P-521 public keys. JWK sets are selected by a matching kid when the token supplies one.
/security-boundaries
What this verifier deliberately does not do
The tool rejects unsigned alg: none tokens, unsupported critical headers, and unencoded JWS payloads. It does not fetch remote JWKS URLs, decrypt five-part JWE tokens, decide whether an issuer is trustworthy, or enforce application-specific audience and permission rules.
/faq
JWT decoder and verifier questions
Is decoding a JWT the same as verifying it?
No. Anyone can decode the header and payload. Verification checks that the signature matches a supplied key; trust and claim validation remain separate decisions.
Do my JWT and key leave the browser?
No. Decoding and verification run locally. Token contents and key material are not included in Data Demon analytics events.
Can I paste a JWKS?
Yes. Paste the JWKS JSON directly. The tool filters for a compatible signing key and uses the token's kid when present. It never downloads a remote key set.