JWT Debugger

No. Decoding only reads the header and payload — anyone can craft a JWT with any claims. A token is only trustworthy once its signature is verified against the correct key, which is why this tool clearly separates "decoded, not verified" from "signature verified."

This first release verifies HS256 (HMAC-SHA256) signatures using a secret you provide, entirely with the browser's Web Crypto API. RSA and ECDSA verification with a pasted public key is a planned follow-up.

No. Parsing and verification happen locally in your browser using JavaScript's built-in base64 decoding and Web Crypto API. The token is never sent to a server, never added to the URL, and never saved to local storage or analytics.

iat (issued at) is when the token was created. nbf (not before) is the earliest time the token is valid. exp (expiration) is when the token stops being valid. All three are Unix timestamps in seconds, and this tool converts them to readable dates and relative times automatically.

Expiration is enforced by whichever server validates the token, not by the token itself. This tool tells you whether the current time is past the exp claim, but if a server isn't checking that claim (or your clock is skewed), behavior may differ.