A JWT is three Base64URL segments separated by dots. The first two are JSON that anyone can read; the third is a signature only the holder of the key can produce. Decoding proves nothing about authenticity — verification does.
That distinction is why this decoder runs in your browser. Pasting a production token into a server-side debugger hands a live credential to someone else's logs.
What the panels show
Header — the algorithm and, often, a kid identifying which key signed it. Never trust the alg value to choose your verification algorithm; pin it server-side.
Payload — the claims. Every timestamp claim is resolved to an ISO date and a relative time, because comparing 1790000000 to now by eye is how expiry bugs survive code review.
Claims table — each claim with what it means. aud is the one most often ignored: an API that does not check the audience will accept a token minted for a different service by the same issuer.
Verifying
Supply a key and the signature is checked in your browser:
- HS256/384/512 — paste the shared secret. Symmetric, so the same value signs and verifies.
- RS, PS, ES — paste the public key in PEM (SPKI) form, from the issuer's JWKS endpoint. Asymmetric, so the public key verifies but cannot sign.
Add the expected audience and issuer and those are checked too. All of it together — signature, audience, issuer, plus the time window — is what "validating a token" actually means. Checking only the signature is a common and serious gap.
Failure modes worth recognising
alg: none. The token declares itself unsigned. A library that honours this accepts forged tokens from anyone. Always pin the expected algorithm.
Five segments instead of three. That is a JWE — encrypted, not merely signed. The payload cannot be read without the decryption key, and no decoder can help.
A valid signature on an expired token. Signature verification and time validation are separate checks. Both must pass.
Confused algorithm. A token signed with HS256 using the RSA public key as the HMAC secret. If your verifier picks the algorithm from the header, an attacker holding your public key can forge tokens. Pin the algorithm.
Frequently asked questions
Is it safe to paste a production token here?
Yes. Decoding and verification happen in your browser via the Web Crypto API. Load the page, disconnect, and it still works. Nothing is transmitted.
Why does my signature fail to verify?
Usually one of four things: the secret has trailing whitespace or a newline; the secret is Base64 in your config and your library decodes it while this tool does not; the token was signed by a different key in a rotating set — check the kid; or the algorithm is asymmetric and you supplied a secret rather than a public key.
Where do I get the public key?
From the issuer's JWKS endpoint, usually /.well-known/jwks.json, matched on the kid in the header. You will need to convert the JWK to SPKI PEM form to paste it here.
Can I use a JWT as an API key?
You can, but be clear about the trade: a JWT cannot be revoked before its exp unless you maintain a denylist, which reintroduces the state that made JWTs attractive. For long-lived credentials, an opaque key you can revoke instantly is usually better.
How long should a token live?
Minutes for access tokens, with a refresh token for continuity. The expiry calculator shows the exposure window each choice creates.