Paste a JWT and get the answers you actually came for: is it still valid, and is the signature real. Expiry is worked out for you in plain language instead of a raw Unix timestamp, every registered claim is named and explained, and the signature is reported as unverified until you supply a key — because decoding a token proves nothing about who signed it. Tokens using alg:none are called out as the authentication bypass they are. You can also build and sign a token here, with HMAC, RSA, ECDSA or EdDSA, so you never have to paste a private key into someone else's server. Decoding, verifying and signing all happen in your browser — nothing is transmitted.
This tool does not use any data storage or network traffic.
..
Validity
Signature
Header
Payload
Claims
| Claim | Meaning | Value |
|---|
Verify the signature
Header
The algorithm selector above writes this header.
Nothing leaves your browser — but a token is still a credential
Decoding, verifying and signing all happen locally using your browser's own crypto. No token, secret or private key is ever sent anywhere, and nothing is stored — reload the page and it is gone. Worth saying plainly though: a real token on screen is a live credential like a password. The remaining risk is not this page, it is a shared screen, a screen recording, or someone behind you.