JWT decoder
Paste a JSON Web Token to read its header and payload, see what the standard claims mean and whether the token has expired, and verify the signature with a secret or a public key. The check runs with your browser's WebCrypto; the token, the secret and the key stay on your machine.
Everything runs in your browser. Nothing you paste is sent anywhere or saved: this page is served with a Content Security Policy that stops it from opening connections (connect-src 'none'), and it has no analytics or ads. Open your browser's Network tab to check that no request carries what you paste.
How to use
Paste a token. The header and payload decode at once; no secret is needed to read them. To check the signature, paste the shared secret for HS algorithms or the public key for RS, PS, ES and EdDSA, then press Verify.