About this tool
Paste a JSON Web Token to decode its header and payload, with issued-at, expiry and not-before claims rendered as readable dates and flagged when expired. Signature verification uses the browser WebCrypto API and supports HMAC (HS256/HS384/HS512) with a shared secret and RSA (RS256/RS384/RS512, PS256/PS384/PS512) with a public key in SPKI PEM form.
Tokens are decoded and verified entirely in your browser. Unlike most online JWT tools, the token and signing key are never sent anywhere — which matters, because pasting a production token into a remote service leaks it.