All tools › For Developers
Decode and Verify JWT
Read a token, see its expiry in plain words, verify an HS256/RS256/ES256 signature or create your own token.
What the tool can do
- The header and payload in readable form; the exp, iat and nbf claims are shown as a date and in words (“expired 3 days ago”).
- Signature verification: HMAC with a secret, RSA, RSA-PSS and ECDSA with a public key in PEM or JWK format.
- Warnings about typical security problems: the none algorithm, no expiry, jku/x5u links.
- Creating an HS256/384/512 token with quick buttons “exp +1 hour” and “iat = now”.
- The token and keys are not sent to a server — verification uses the browser's built-in cryptography.
The data in a JWT is not encrypted, only signed: anyone can read it. Do not put passwords or other secrets in a token.
It is better not to paste other people's working tokens into third-party sites. Here the check runs locally, but the security principle remains a good habit.