Paste a JSON Web Token to decode its header and payload, read the expiry and issued-at times, and verify the signature locally. The token and any key you enter stay in your browser.
Optional — set what this token is expected to satisfy. Leave a field blank to skip that check. These checks run against the decoded claims regardless of whether the signature below verifies.
No policy fields are set — nothing to check yet.
This token uses alg: none — it is unsigned and cannot be verified.
This browser's Web Crypto does not expose Ed25519, so EdDSA cannot be verified here. Modern Firefox, Safari and Chrome do.Algorithm {{decoded.header.alg}} is not supported here. HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512 and EdDSA (Ed25519) can be verified.
This token's header declares {{tokenJku ? 'jku' : 'x5u'}}: {{tokenJku || tokenX5u}} — it is never fetched automatically. Only use JWKS (URL) below with an address you trust; blindly trusting a token-supplied key location is exactly how jku/x5u signature-forgery attacks work.
Paste either the raw x claim from the JWK (43 base64url characters) or a PEM SPKI public key.
kid{{jwksKeyStatus}}
{{jwksKeyStatus}}
A JWT is three Base64URL segments — header, payload, signature — joined by dots. Decoding just reverses the Base64URL encoding to read the JSON; it doesn't require a key, which is why anyone can read a token's claims without being able to forge one.
Verifying the signature does require the right secret (HMAC) or public key (RSA/ECDSA/Ed25519), and runs through the browser's native Web Crypto API — the same primitives a server would use.
Privacy: decoding, signature verification and key matching happen entirely in your browser with the Web Crypto API — the token, secret and any key you paste never leave this page. The one exception is "Fetch JWKS" on the JWKS (URL) tab: clicking it fetches whatever URL you enter directly from your browser to retrieve public keys, exactly like a real verifier would. The token and any secret are never sent to that URL, and nothing routes through this site — but the fetch itself is a real network request, made only when you press that button, never automatically from the token's own jku/x5u header.
