Does this verify the signature?

Yes. Verification runs in the browser with the jose library. HMAC algorithms use the secret you paste. RSA, RSA-PSS, ECDSA, and EdDSA use a public key in PEM, JWK, or JWKS form, matched by kid when the header has one.

Is the token sent to a server?

No. Decoding, verification, and signing stay in the browser. The token and keys are not posted and they are not stored.

What does alg none mean?

The header says the token has no signature algorithm. Anyone can edit the payload. An app should reject alg none instead of treating the payload as trusted.

Can I create a token here?

Yes. The Encode tab signs a header and payload with HS256, HS384, or HS512. Asymmetric signing needs a private key, and this page does not ask for one.

Can I decode an encrypted token?

No. An encrypted JWE has five segments and the payload stays ciphertext without the key. This page only reads a signed JWT, which has three segments.

JWT decoder

Paste a JSON Web Token, read the claims, and verify the signature in the browser.

In A signed JWT, plus an optional HMAC secret or public key./Out Header JSON, payload JSON, claim times, and a signature result. An encode tab signs test tokens.

How to use it

1Paste the tokenCopy a JWT from an Authorization header, a cookie, or a session. A Bearer prefix is stripped.
2Add the secret or public keyHS256, HS384, and HS512 use a shared secret. RS, PS, ES, and EdDSA use a public key as PEM, a JWK, or a JWKS document.
3Read the checksA verified badge means the signature matches. exp, nbf, and iat are shown as a relative phrase and a UTC time.