How it works
A JWT is three base64url parts separated by dots: header (algorithm), payload (claims) and signature. Decoding needs no key: anyone holding the token can read it. Never put secrets in a payload.
Time claims (iat issued at, nbf not before, exp expiry) are Unix seconds; the tool shows them as dates with a live “expires in…” countdown.
Verifying
Verification uses the browser’s Web Crypto API:
| alg | Key to paste |
|---|---|
| HS256 / HS384 / HS512 | the shared secret |
| RS256…512, PS256…512 | RSA public key, as JWK or PEM (BEGIN PUBLIC KEY) |
| ES256 / ES384 / ES512 | EC public key (P-256/P-384/P-521), as JWK or PEM |
Privacy
Tokens are credentials. This page never writes the token or the key to the URL or to storage, and the site’s security policy blocks network requests, so nothing leaves your browser.