Free developer tool

JWT decoder & verifier

Decode JWT claims, check exp and nbf times, and optionally verify the signature with a local PEM certificate or public key without uploading either file.

Runs locallyUpdates as you type

Optional certificate or public keyWithout a key, claims are checked for time validity but the signature is not verified.

Input

Output

Your result will appear here.

Processed only on this device

About this tool

What jwt decoder & verifier does

Read a signed JWT header and payload, inspect time claims, and optionally verify its signature against an uploaded X.509 certificate or public key.

How it works

The bundled JOSE implementation decodes the compact token and checks time claims. When you load a PEM certificate or public key, Web Crypto verifies the declared asymmetric signature algorithm locally. No issuer metadata or key is fetched.

Common uses

When to use it

Inspect token claims during local development
Check expiry, issuer, audience, and scope fields
Review whether a token contains expected custom claims

Scope

Limits to know

Without a supplied key, decoded claims remain untrusted
Issuer and audience are displayed but cannot be policy-validated without expected values
Encrypted JWTs and symmetric shared-secret verification are not supported

Worked example

Example input and result

Use the prefilled value in the tool above or paste a similar value of your own.

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZW1vIiwic2NvcGUiOiJyZWFkIn0.invalid

Result

Header: { "alg": "none", "typ": "JWT" }
Payload: { "sub": "demo", "scope": "read" }

Quick answers