What you get that a plain decoder doesn't show
- Times you can read —
exp,iatandnbfin your own time zone and as “expires in 42 min”, updating live. - Security red flags —
alg: none, missing or very long expiry, millisecond timestamps, remote key URLs and passwords or card numbers sitting in the payload. - Every claim explained — standard and common OpenID / Azure AD claims get a short description.
- Real verification — HS256/384/512, RS256/384/512, PS256/384/512 and ES256/384/512 with a secret, PEM public key, JWK or a whole JWKS (matched by
kid).
Is it safe to paste a real token?
Decoding and verification run entirely in this page with the Web Crypto API — the token, secret and keys are never sent anywhere, and nothing is stored. Still, treat production tokens like passwords: prefer test tokens, and never paste a private key into any website.
Frequently asked questions
Is a JWT encrypted?
No. A normal JWT (JWS) is only Base64URL-encoded and signed — anyone holding it can read the payload. The signature proves who issued it and that it wasn't changed. Encrypted tokens (JWE) have five parts and can't be read without the key.
Where do I find the public key?
Most identity providers publish it at /.well-known/jwks.json (the jwks_uri in their OpenID configuration). Paste the whole JSON — the right key is picked by the token's kid.
Why is my token “expired” when it just worked?
Check your computer's clock — expiry is compared to your device time. Servers usually allow a minute or two of clock skew.