Does decoding verify the token?

No. Decoding only reveals untrusted JSON. Verification checks a signature with the key you provide; you must separately validate issuer, audience and authorization requirements.

Which key formats and algorithms are supported?

HMAC supports HS256, HS384 and HS512 with UTF-8 or Base64 secrets. RSA, RSA-PSS and ECDSA support the 256, 384 and 512 variants with an SPKI PEM or public JWK. Unsupported algorithms and critical extensions are reported.

Are tokens or verification keys uploaded or saved?

No. Processing runs in your browser. Only algorithm and secret-encoding preferences are saved. Tokens and keys are temporary, and no token share link is created.

ToolHub

JWT Decoder

Decode JWT headers and claims, inspect time validity, and verify HMAC, RSA, PSS or ECDSA signatures locally with your key.

Stable

Online

Decoding and verification happen locally. Tokens and keys are never saved, shared in links, or sent to a server.

Paste a JWT to inspect its header and payload.

JWT token

0 characters

Shared secret

Use a trusted key obtained separately from the token. Public PEM keys must use BEGIN PUBLIC KEY. No key URLs are fetched.

Select the algorithm you expect from the token issuer. A mismatch prevents verification. Unsupported critical JWS extensions are rejected.