JWT decoder and verifier

About this tool

Decodes a JWT's header and claims, shows when it expires, and can verify the signature for HS256/384/512 with a shared secret or RS256/384/512 with a public key, using the browser's WebCrypto. It refuses alg=none. Nothing leaves the page.

Good for

• Seeing what claims, scopes, and expiry an identity provider actually issued
• Debugging 'invalid token' errors: wrong audience, expired token, or clock skew
• Checking that a token verifies against the key you think it was signed with

Not for

• ES256, PS256, or EdDSA tokens, which it can't verify yet
• Proving your service validates tokens correctly: test that in the service itself
• Live production tokens if you can avoid it: a valid JWT is a bearer credential, so prefer expired or test tokens

Further reading on mikepreston.org

• You Probably Don't Need JWT: Server-Side Sessions Are Still the Right Default
• Passwords, Authentication, and Why We're Still Getting It Wrong
• Key Management: The Bit That Actually Bites You