SECURITY / AUTHENTICATION DEBUGGING

JWT Decoder & Signature Validator

Inspect JSON Web Tokens, decode standard JWT claims, check expiry and not-before timestamps, and verify HS256/384/512 or RS256/384/512 signatures locally using Web Crypto.

Token inspector

JWT (header.payload.signature)

JWT payloads are untrusted until the signature is verified.

Signature verification

Algorithm is selected from token header —

Shared secret (HS*) or PEM public key (RS*)

Expected issuer (optional) Expected audience (optional)

seconds clock tolerance

Not verified

Decoded claims

Header

—

Payload

—

JWT validation guidance

Decoding a JWT does not prove that it is authentic. Verify its signature using the correct key and algorithm, then review exp, nbf, iss and aud against your application's expectations. This tool verifies the signature and checks temporal claims, but does not fetch issuer keys, validate revocation or enforce application-specific issuer/audience rules. It never sends token text or keys to the server.