Paste a JSON Web Token to decode its header and payload, read the expiry and issued-at times, and verify the signature locally. The token and any key you enter stay in your browser.
This token uses alg: none — it is unsigned and cannot be verified.
Algorithm {{decoded.header.alg}} is not supported here. HS256/384/512, RS256/384/512, PS256/384/512 and ES256/384/512 can be verified.
A JWT is three Base64URL segments — header, payload, signature — joined by dots. Decoding just reverses the Base64URL encoding to read the JSON; it doesn't require a key, which is why anyone can read a token's claims without being able to forge one.
Verifying the signature does require the right secret (HMAC) or public key (RSA/ECDSA), and runs through the browser's native Web Crypto API — the same primitives a server would use.
Decoding and verification happen entirely in your browser. The token, secret and key never leave this page.
