How it works
A JSON Web Token has three Base64URL parts separated by dots: the header, the payload and the signature. Decoding only reads the first two, so it works offline and never proves who issued the token. Only a signature check against the issuer's key proves authenticity, and an expired token should be rejected even with a valid signature.
header.payload.signature → JSON + dates + signature check
Which key to use
- HS256 / HS384 / HS512: paste the shared secret text. Anyone holding it can both sign and verify.
- RS256–RS512 / PS256–PS512: paste the public key as PEM (SPKI) or JWK. The private key stays with the issuer.
- ES256 / ES384 / ES512: paste the EC public key as PEM or JWK; the raw R‖S signature inside the token is converted automatically.
- EdDSA: paste the 32-byte public key as Base64URL or hex.
- none: no signature at all. Such tokens must never be trusted.
Tips
- exp, iat and nbf are shown as dates with whether each one already passed.
- Pasting a real access token here is safe from the network, but anyone with the token can use it — prefer short test tokens.
- Everything runs in your browser; nothing is uploaded.
Standards and sources
- JSON Web Token (JWT): RFC 7519; JWS signatures: RFC 7515
- Algorithms (HS/RS/PS/ES): RFC 7518; EdDSA: RFC 8032
- Base64URL: RFC 4648
Last reviewed October 12, 2026
Frequently asked questions
What does decoding prove?
Nothing about authenticity. Decoding only reads the header and payload, which anyone can forge. Only a signature check with the issuer's key proves the token is genuine.
Which algorithms can be verified?
HMAC (HS256/384/512) with the shared secret, RSA (RS/PS) and ECDSA (ES256/384/512) with a PEM or JWK public key, and EdDSA (Ed25519) with the raw public key. Tokens with alg none have no signature and must never be trusted.
Why is my valid token rejected by the server?
The usual reasons are an expired exp claim, a wrong audience or issuer, or clock skew between signer and server. This page shows each date claim so you can spot which one fails.
Is it safe to paste a real token here?
The page works fully offline and sends nothing anywhere, but anyone holding the token can use it until it expires. Prefer short-lived test tokens over production access tokens.