Skip to content
ToolForUser
  • Image CompressorImage Tools · Make photos and graphics smaller by re-encoding them as JPG or WebP, with a quality slider and optional downscaling.
  • Image ResizerImage Tools · Change the width and height of an image in pixels or by percentage, with high-quality downscaling.
  • Image ConverterImage Tools · Change the format of one or many images to JPG, PNG or WebP, with control over quality and transparency.
  • Image CropperImage Tools · Cut out part of an image with a draggable selection, aspect ratio presets and exact pixel inputs.
  • Rotate & Flip ImageImage Tools · Turn a picture by 90° or 180° and mirror it horizontally or vertically, with a live preview.
  • Merge PDFPDF Tools · Combine several PDF files into one document, in the order you choose, with optional page ranges per file.
  • Split PDFPDF Tools · Extract pages into a new PDF or split a document into several files by page, range or fixed page count.
  • Reorder PDF PagesPDF Tools · Change the page order of a PDF with drag and drop, delete unwanted pages and save the result.
  • Rotate PDFPDF Tools · Turn individual pages or the whole document by 90° steps, preview the result and save the corrected PDF.
  • Images to PDFPDF Tools · Combine photos and scans into a single PDF, one image per page, with page size, orientation and margin options.
  • PDF to JPG / PNGPDF Tools · Turn PDF pages into JPG or PNG images at the resolution you need and download them as one image or a ZIP.
  • Sign PDFPDF Tools · Create a signature by drawing, typing or uploading it, place it on the pages of a PDF and save the signed file.

JWT Decoder & Verifier

Decode a JWT, see when it expires and check its signature with a secret or public key.

Runs locally in your browser – your data is not uploaded

Loading tool…

About the JWT Decoder & Verifier

A JSON Web Token (JWT) is a compact string of three base64url parts separated by dots: a header that names the signing algorithm, a payload with claims such as the user ID and expiry time, and a signature. Anyone can decode the first two parts – they are encoded, not encrypted – but only the signature tells you whether the token was really issued by someone who holds the key.

This tool decodes the header and payload, turns the exp, nbf and iat timestamps into readable dates and tells you whether the token has expired. If you paste the signing secret or the issuer’s public key, it also verifies the signature. Tokens and keys are processed in your browser and are never sent to a server, which matters because access tokens grant access to real accounts.

How to use it

  1. Paste the token into the Token box. A leading "Bearer " and line breaks are removed automatically.
  2. Read the decoded Header and Payload, and check the Claims table for the issuer, subject, audience and validity period.
  3. To check the signature, go to "Verify signature". For HS256, HS384 or HS512 enter the shared secret; tick "Secret is base64-encoded" if it is.
  4. For RS, PS, ES or EdDSA tokens paste the public key as a PEM block, an X.509 certificate, a JWK or a whole JWKS.
  5. Click Verify. The result shows whether the signature is valid.

Features

  • Readable claims: Expiry, not-before and issued-at times are shown in UTC, in your time zone and relative to now, with a live status.
  • Signature verification: Supports HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512 and EdDSA (Ed25519) using your browser’s Web Crypto API.
  • Flexible key input: Accepts SPKI PEM public keys, X.509 certificates, single JWKs and JWK sets, where the key is picked by its kid.
  • Clear error messages: Tells you whether a token has the wrong number of parts, invalid base64url or invalid JSON, or is an encrypted JWE.
  • Private by design: Nothing is uploaded or stored. Keys stay in this browser tab and are gone when you close it.

Examples

Why does the API return 401?

Paste the access token from the failing request. The Claims table shows "Expired" and the expiry time in your time zone, so you know the client did not refresh the token.

Checking an ID token from an identity provider

Copy the provider’s JWKS document (from its jwks_uri) and paste it as the key. The tool selects the key with the matching kid and verifies the RS256 signature.

Debugging an HS256 integration

Paste a token and your shared secret. If the signature does not match, check whether the secret is base64-encoded on one side and plain text on the other.

Limitations and notes

  • Encrypted tokens (JWE, five parts) cannot be decrypted.
  • Keys are not downloaded from a JWKS URL – copy the JSON from the URL and paste it instead.
  • PKCS#1 "BEGIN RSA PUBLIC KEY" blocks are not supported; convert them to an SPKI "BEGIN PUBLIC KEY" block first.
  • Verification checks the signature only. Whether the issuer, audience and other claims are acceptable depends on your application.
  • Older browsers may not support EdDSA (Ed25519); the tool tells you if a key or algorithm is not supported.

Frequently asked questions

Is it safe to paste a token here?

The token is decoded by JavaScript in your browser and is not sent anywhere. Even so, treat production tokens like passwords: prefer expired or test tokens when you can.

Can anyone read the contents of a JWT?

Yes. The header and payload are only base64url-encoded. Never put secrets in a JWT payload; the signature only protects against changes, not against reading.

What does "Invalid signature" mean?

The token was changed after signing, or it was signed with a different key than the one you provided. Make sure you are using the right secret or the public key that matches the kid in the header.

Do I need the private key to verify a token?

No. RS, PS, ES and EdDSA tokens are verified with the public key. The tool refuses private keys so they are not pasted by accident.

Why is a token with "alg": "none" not verified?

Such a token has no signature, so there is nothing to check. Servers should reject unsigned tokens unless they explicitly expect them.

More free tools