JWT Decoder & Verifier

Paste a token to see its header, payload, whether the signature is valid, and its expiry and algorithm risks. Nothing is stored.

Notes

The token and key are used once, in memory, for this request only — never written to disk or logs.
Online verification is for debugging. In production use an SDK and always validate alg, iss, aud and exp.
Covers HS*/RS*/PS*/ES*; other algorithms (e.g. EdDSA) show as unsupported.