JWT decode / verify
Decode a JWT's header and payload. Signature verification only covers HS256/384/512 (via WebCrypto HMAC). RS*/ES*/PS* tokens are decoded but not verified, since that needs asymmetric key material this tool has no way to be given. Runs on your device.
Runs on your device. The file is never uploaded.
JWT decode / verify splits a pasted token on its dots and prints the header and payload as JSON, then one line about the signature. HS256, HS384 and HS512 are recomputed against the secret field with WebCrypto HMAC; every other algorithm is decoded and left unverified. No expiry, issuer or audience check happens, whatever the payload says.
Questions
Does this verify the signature?
For HMAC tokens, yes. If the header alg is HS256, HS384 or HS512, the tool recomputes the HMAC over the header and payload with the secret you type in and reports "signature VALID for the given secret" or "signature INVALID for the given secret". For anything else it decodes only, and says so in the output.
Why does it say my RS256 token is not verified?
Because verifying it needs a public key, and there is nowhere to give the tool one. RS, ES and PS tokens are decoded and shown in full, and the last line reads that the signature was not verified because that algorithm "needs asymmetric key material, not implemented". A token with alg none has no signature to check at all.
Is the payload of a JWT private?
No. The header and payload are Base64URL-encoded JSON, not encrypted, so anyone holding the token can read every claim in it without a secret. The signature only proves the token was not altered by someone without the key. Never put anything confidential in a JWT payload.
Does it check whether the token has expired?
No. It prints the payload as JSON, so you can see exp, iat, iss and aud, but nothing here compares them against the clock or against an expected issuer or audience. The only judgement it makes is the signature line. Expiry and audience checks belong in your own verification code.
What do the error messages mean?
A token that does not split into exactly three dot-separated pieces gives "not a JWT: expected 3 dot-separated parts, got" and the count you supplied. If a piece decodes but is not JSON you get "bad JWT header:" or "bad JWT payload:" with the parser message, which usually means the token was truncated or copied with a stray character.
Is my token or my secret sent anywhere?
No. This tool takes no file; you paste the token and the secret into the fields on the page, and both stay in the tab. The HMAC is computed with the browser WebCrypto API in a Web Worker, so a production signing secret typed here is never transmitted or stored. The page comes prefilled with a sample token and secret so you can see the output shape first.